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I. 


INTRODUCTION 


A.  BACKGROUND 

In  the  21st  century,  the  United  States  Marine  Corps  (USMC)  faces  an  increasingly 
complex  geo-political  climate  while  operating  in  a  constrained  budgetary  environment. 
This  situation  requires  the  USMC  to  “balance  fiscal  responsibility  and  mission 
accomplishment”  (Nally,  2013).  Balancing  budget  and  mission  requires  innovative 
solutions  to  current  problems.  One  such  innovation  that  could  potentially  save  the  USMC 
money,  while  increasing  the  ability  to  prepare  for  and  conduct  its  mission  is  the  use  of 
commercial  mobile  devices  (CMD). 

Cebrowski  and  Garstka  (1998)  identified  information  technology  (IT)  as  central  to 
increasing  return  on  investment  (ROI)  and  competing  in  the  modern  economy,  and  that 
the  use  of  IT  would  be  central  to  meeting  the  demands  of  modern  network-centric 
warfare.  IT  has  the  potential  be  a  force-multiplier  for  the  Department  of  Defense  (DOD); 
IT  also  has  the  potential  to  be  a  significant  limiter  of  productivity  and  effectiveness  if 
new  technology  is  not  properly  implemented. 

The  Director  of  the  USMC’s  Command,  Control,  Communications,  and 
Computers  Department  (C4)  recognized  that: 

The  user  requirement  to  access  and  share  information  from  non-traditional 
workspaces  will  enable  more  efficient  mission  accomplishment.  The 
ability  to  access,  share  and  manipulate  data  and  information  from  non- 
traditional  workspaces  will  afford  users  with  additional  freedom  of 
movement  across  and  expanding  information  environment.  (Nally,  2013) 

This  statement  from  the  USMC  Director  of  C4  directly  addresses  the  Marine 
Corps  need  for  mobility  in  the  IT  used  by  its  workforce.  Implementing  a  policy  allowing 
CMD  technology  in  the  USMC  has  the  potential  to  increase  the  mobility  and  efficiency 
of  the  workforce  while  decreasing  costs. 

CMD  technology  implementation  has  risks  associated  with  legal  ownership  of 
data  and  the  device  itself,  as  well  as  issues  in  terms  of  security  validation  of  users 
(Anderson,  2013,  p.  10).  The  Marine  Corps  recognizes  that  the  security  of  the 
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government  network  is  a  key  tenet  to  implementing  and  realizing  the  potential  benefits  of 
this  technology  (Anderson,  2013,  p.  10).  From  an  IT  security  standpoint,  the  most  secure 
course  of  action  for  the  DOD  could  be  to  forbid  the  use  of  CMDs  to  conduct  business. 
This  could  be  the  most  secure  choice,  but  this  choice  would  deny  the  affected  subordinate 
units  the  improved  efficiency  and  effectiveness  that  CMD  usage  has  enabled  in  other 
organizations.  Intel  Corporation  knew  that  corporate  oversight  and  security  could  be 
more  easily  assured  by  restricting  CMD  usage.  They  also  recognized  that  such  a  policy 
would  make  it  a  less  attractive  employer  in  an  industry  that  was  seeing  increased 
competition  for  talented  employees  (Chandrasekhar,  2013,  p.  2). 

The  Clinger-Cohen  Act  (1996)  directs  the  continuing  assessment  of  the  IT 
management  experiences  of  other  government  organizations,  international  organizations, 
and  the  private  sector.  This  research  follows  the  Clinger-Cohen  Act  (1996)  directive  by 
assessing  the  implementation  of  CMD  policies  in  a  variety  of  organizations  in  order  to 
better  understand  how  implementation  of  similar  policies  could  impact  the  DOD  and, 
more  specifically,  the  USMC.  Using  the  experiences  of  these  organizations,  this  research 
will  develop  three  case  studies  that  illustrate  the  potential  effect  CMD  technology  could 
have  in  various  USMC  business  processes. 

B.  PROBLEM  STATEMENT 

There  is  little  empirical  data  concerning  the  implications  of  the  increased  use  of 
commercial  mobile  devices  in  the  United  States  Marine  Corps.  This  is  a  problem  because 
the  United  States  Marine  Corps  is  operating  in  an  increasingly  resource  limited  and 
fiscally  constrained  environment  while  simultaneously  becoming  more  dependent  on 
information  technology  systems  to  efficiently  train  and  operate.  Leveraging  the  use  of 
personally  procured  computing  devices  may  allow  the  United  States  Marine  Corps  to 
become  even  more  efficient,  productive,  and  better  positioned  to  carry  out  its  mission. 

C.  PURPOSE  STATEMENT 

The  purpose  of  this  research  is  to  explore  scenarios  where  implementation  of 

policies  allowing  the  use  of  commercial  mobile  devices  could  allow  the  United  States 

Marine  Corps  to  achieve  higher  productivity  while  minimizing  IT  investment.  This  is 
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important  because  the  United  States  Marine  Corps  now  is  carrying  out  more  complex 
operations  around  the  world,  often  under  austere  conditions.  In  order  to  be  better 
prepared  to  conduct  these  operations,  the  United  States  Marine  Corps  may  be  able  to 
benefit  from  better  understanding  how  other  organizations/companies  address  the  use  of 
commercial  mobile  devices  and  how  United  States  Marine  Corps  could  possibly 
implement  the  use  of  these  devices. 

D.  RESEARCH  QUESTIONS 

This  thesis  seeks  to  answer  the  following  questions: 

•  What  are  the  organizational  and  policy  implications  of  using  personal 
commercial  mobile  devices  in  the  Marine  Corps? 

•  What  are  the  organizational  and  policy  implications  of  using  personal 
commercial  mobile  devices  on  completing  computer  based  training? 

•  What  are  the  organizational  and  policy  implications  of  using  personal 
commercial  mobile  devices  in  scheduling  and  completing  unit  level 
training? 

•  What  are  the  organizational  and  policy  implications  of  using  personal 
commercial  mobile  devices  in  conducting  a  safety  or  mishap 
investigation? 

E.  RESEARCH  GOALS 

The  goal  of  this  research  is  to  increase  the  understanding  of  how  the  use  of 
commercial  mobile  devices  on  Marine  Corps  networks  may  be  implemented  in  a  manner 
that  takes  into  account  confidentiality,  integrity,  and  accessibility.  Through  the 
development  of  case  studies  and  the  analysis  of  potential  courses  of  action,  this  research 
is  intended  to  provide  a  better  understanding  of  the  social  and  technical  implications  of 
implementing  this  technology.  The  desired  end-state  of  this  research  is  that  decision 
makers  within  the  Marine  Corps  have  a  better  understanding  of  the  risks  and  benefits 
associated  with  implementing  this  technology. 

F.  THESIS  ORGANIZATION 

Chapter  II  is  a  discussion  of  CMD  technology,  implementation  strategies,  and  the 

Information  Systems  Strategy  Triangle  in  effort  to  understand  the  complexity  associated 
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with  implementing  this  technology.  This  discussion  proceeds  on  into  a  discussion  about 
the  strategic  focus,  and  plans  and  policies  of  the  federal  government,  Department  of 
Defense  (DOD),  Department  of  Navy  (DON),  and  the  United  States  Marine  Corps 
(USMC)  in  order  to  better  understand  how  the  organizational  and  business  strategy 
should  drive  the  information  strategy.  Chapter  II  goes  on  to  discuss  the  concepts  of  the 
sociotechnical  systems  theory,  technology  acceptance  model,  and  the  confidentiality, 
integrity,  and  availability  (CIA)  triad  in  order  to  provide  a  framework  for  analyzing  the 
courses  of  actions  developed  in  Chapter  III. 

Chapter  III  provides  three  separate  case  studies,  which  present  particular 
scenarios  that  could  benefit  from  the  implementation  of  CMD  technology  through 
application  based  access.  Each  case  is  described  in  detail,  as  are  the  potential  uses  of 
CMD  technology  in  each  particular  instance.  Each  case  offers  three  potential  courses  of 
action  that  vary  in  terms  of  the  implementation  strategy  and  the  responsibilities  from  the 
perspective  of  the  organization  and  the  end  user. 

Chapter  IV  analyzes  each  case  and  each  course  of  action  with  emphasis  on  the 
risks  and  benefits  in  terms  of  confidentiality,  integrity,  and  availability  from  the 
perspective  of  the  organization  and  the  end  user.  Using  sociotechnical  systems  theory  and 
the  technology  acceptance  model,  this  chapter  will  address  the  interaction  between  the 
technology  and  the  individual  of  each  course  of  action. 

Chapter  V  is  a  summary  of  the  research,  conclusions,  and  recommended  courses 
of  action  for  the  individual  cases.  The  recommendations  will  provide  the  reader  a  better 
understanding  of  the  complex  interaction  between  the  individual  and  the  technology. 
Additionally,  this  chapter  offers  recommendations  for  follow-on  research  in  this  area  of 
study. 
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II.  LITERATURE  REVIEW 


The  Department  of  Defense  (DOD)  looks  at  information,  digital  or  otherwise,  as  a 
strategic  asset,  which  is  a  characterization  of  the  way  the  information  used  and  protected 
(DOD  CIO,  2016,  p.  2).  Certainly  any  information  that  is  “classified”  or  that  contains 
Personally  Identifiable  Information  (PII)  must  be  safeguarded  from  exposure  to  threats  as 
described  in  U.S.  laws.  However,  decreasing  or  limiting  availability  of  data  comes  at  a 
cost  in  terms  of  employee  productivity.  The  current  resource  limitations  and  the 
increasing  complexity  of  the  threats  faced  by  the  DOD  could  potentially  benefit  from  the 
implementation  of  a  new  policy  that  embraces  technology  available  to  employees 
commercially. 

A.  COMMERCIAL  MOBILE  DEVICE  TECHNOLOGY 

The  United  States  Marine  Corps  (USMC)  and  the  wider  Department  of  Defense 
(DOD)  operate  in  a  resource-constrained  environment.  One  way  that  the  DOD  could 
possibly  gain  an  advantage  in  this  environment  is  by  implementing  a  policy  that  allows 
the  use  of  CMDs,  either  personally  owned  or  government  furnished.  For  the  purposes  of 
this  research,  CMDs  will  be  defined  as  set  forth  in  the  Department  of  Defense 
Commercial  Mobile  Device  Implementation  Plan.  In  this  definition,  CMDs  are  described 
as  a  “subset  of  portable  electronic  devices  (PED)”  that: 

provide  one  or  more  commercial  wireless  interfaces  along  with  a  compact 
user  input  interface  (touch  screen,  miniature  keyboard,  etc.)  and  exclude 
PEDs  running  a  multi-user  operating  system  (Windows  OS,  Mac  OS,  etc.). 

This  definition  includes  but  is  not  limited  to  smart  phones,  tablets,  and  e- 
readers.  (DOD  CIO,  2013,  p.  25) 

CMDs  can  vary  greatly  in  computing  capacity,  operating  system,  and  security 
capability.  For  the  purposes  of  this  research,  CMDs  are  characterized  as  having  the 
ability  to  connect  to  the  Internet,  being  highly  portable,  instantly  accessible  to  the  user, 
and  having  similar  processing  and  data  storage  capability  as  desktop  or  laptop  systems  at 
a  lower  cost  (Tucker,  2010,  p.  1).  Each  of  these  commonalities  of  CMDs  offers  potential 
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benefits  to  the  USMC  and  DOD  in  terms  of  workforce  mobility  and  interconnectedness, 
but  they  also  have  potential  negative  aspects  in  terms  of  security  of  information. 

B.  IMPLEMENTATION  STRATEGY  CATEGORIES 

With  regard  to  implementation  strategies,  four  categories  of  implementation  are 
discussed,  each  having  varying  positives  and  negatives  from  the  point  of  view  of  the 
employee  and  that  of  the  enterprise.  In  Gajar,  Ghosh,  and  Rai  (2013,  p.  64),  the  authors 
identified  and  described  each  of  these  implementation  strategy  categories  as  Here  is  Your 
Own  Device  (HYOD),  Choose  Your  Own  Device  (CYOD),  Bring  Your  Own  Device, 
(BYOD),  and  On  Your  Own  Device  (OYOD).  Each  of  these  categories  will  be  discussed 
in  detail,  with  the  emphasis  on  the  possible  benefits  to  the  DOD  and  USMC  from  each. 
These  four  implementation  strategy  categories  span  from  low  levels  of  enterprise  control 
to  higher  levels,  and  from  low  employee  satisfaction  to  high  employee  satisfaction,  as 
displayed  in  Figure  1. 


On  Your 
Own 
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Enterprise  Controls 
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Bring 
Your  Own 


Choose 
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Enterprise  Controls 
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Your  Own 


Employee 

Satisfaction 


Figure  1.  Implementation  Categories.  Source:  Grajar  et  al.  (2013,  p.  64). 
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This  research  will  look  at  each  of  these  four  implementation  categories  and  assess 
the  potential  benefits  and  limitations  of  each  using  USMC  specific  case  studies. 

a.  Here  is  Your  Own  Device  (HYOD) 

In  this  implementation  category,  the  organization  is  responsible  for  providing  the 
CMD.  The  enterprise  has  complete  control  over  the  device  in  terms  of  settings  and 
configuration  of  the  device.  The  organization  is  responsible  for  procuring  the  device, 
setting  up  the  device,  maintaining  the  device  (Grajar  et  al.,  2013,  p.  64).  From  the  point 
of  view  of  the  enterprise,  this  category  provides  the  most  control  and  leads  to  the  best 
network  security,  comparatively  (Grajar  et  al.,  2013,  p.  64).  This  implementation  plan  is 
essentially  the  same  as  the  current  DOD  and  USMC  “privileged  user”  access  program. 
In  this  program,  “privileged  users”  are  provided  government  furnished  equipment  (GFE) 
if  they  are  identified  as  “being  mission  critical  or  mission  essential”  (Anderson,  2013, 
p.  11).  In  Mercado,  and  Spain  (2014,  p.  3),  the  researchers  surveyed  over  15,000  Active- 
duty  Army  Soldiers  on,  among  other  things,  their  willingness  to  use  an  “Army-issued 
smartphone.”  The  results  showed  that  80%  of  respondents  would  be  willing  to  use 
the  smartphone.  The  various  activity  usages,  broken  down  by  age  group,  are  shown  in 
Table  1. 


Table  1.  HYOD  Army  Usage.  Source:  Mercado  and  Spain  (2014,  p.  12). 


Percentage  of  Activities  Soldiers  Reportedly  W ould  Use  An  Army-Issued  Smartphone  For  By 
Age 


Variable 

Official 
phone  and 
email 

Access  to 
online 
training 

Personal 

organizing 

Social 

networking 

Text 

messaging 

Battle 

tracking 

Access  to 
technical/field 
manuals 

under  20 

64% 

56.3% 

55.9% 

36.9% 

62.9% 

34.8% 

55.2% 

20-24 

74.7% 

57.9% 

65.6% 

35.2% 

69% 

43.3% 

66.1% 

25-29 

85.9% 

57% 

73.7% 

34.3% 

71.9% 

43.9% 

69.4% 

30-34 

91.3% 

58.7% 

76.9% 

34.6% 

73.2% 

44.9% 

71.9% 

35-39 

93% 

54.7% 

78.6% 

30.6% 

70.7% 

41.2% 

70.2% 

40-44 

93.8% 

52.9% 

76.9% 

28.3% 

69.3% 

37.5% 

64.4% 

45-49 

94.7% 

52.7% 

75.1% 

28% 

69.3% 

37.1% 

63.8% 

50  or 
older 

95.6% 

49.3% 

70.6% 

23.2% 

61.5% 

28.4% 

55.4% 

Total 

80.1% 

66.9% 

73.6% 

31.9% 

70% 

40.8% 

66.9% 
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From  a  review  of  Table  1,  some  interesting  insights  about  potential  use  of  a  CMD 
in  a  HYOD  implementation  can  be  determined.  First,  the  older  users  (Mid-Grade  and  up 
Officers,  and  Staff  Non-commissioned  Officers)  show  a  higher  percentage  use  of  the 
CMD  for  “Personal  Organizing”  and  “Official  phone  and  email,”  whereas  the  younger 
users  (Junior  Officers,  and  Enlisted)  show  a  higher  percentage  use  for  “Access  to  online 
training.”  This  insight  into  usage  could  transfer  over  to  the  other  implementation 
categories.  One  important  consideration  is  that  of  “smartphone”  ownership  among  the 
younger  age  demographics.  In  Mercado  and  Spain  (2014,  p.  7),  the  researchers 
determined  that  younger  users  were  more  likely  to  own  tablet  or  e-reader,  and  less  likely 
than  their  older  counterparts  to  own  a  “smartphone.”  The  researchers  believed  that 
“smartphone”  ownership  was  lower  due  to  the  high  cost  of  service  contracts  in 
comparison  to  income  in  this  demographic  (Mercado  &  Spain,  2014,  p.  23).  It  is  not 
reasonable  to  expect  that  everyone  owns  a  CMD,  and  therefore  if  a  strategy  of  achieving 
total  workforce  mobility  is  desired,  then  the  government  will  likely  have  to  furnish 
devices  or  provide  a  CMD  stipend  to  offset  the  costs  to  the  user. 

The  expansion  of  the  “privileged  user”  program  to  include  a  larger  segment  of  the 
total  workforce  in  the  DOD  or  USMC  would  mean  the  government  procuring  a  CMD  for 
a  larger  number  of  people  and  then  requiring  the  IT  professionals  in  subordinate  units  to 
maintain  that  equipment.  This  could  result  in  a  considerable  increase  in  cost  in  initial 
procurement,  personnel  training,  and  maintenance,  as  well  as  the  commercial  cellular 
access  contract.  That  being  the  downside  of  this  strategy,  the  benefit  is  the  amount  of 
security  and  control  that  the  enterprise  would  have  over  those  devices.  In  summary,  a 
HYOD  strategy  provides  maximum  control  to  the  enterprise  while  allowing  the  employee 
minimal  freedom  in  choice  of  CMD,  operating  system,  etc. 

b.  Choose  Your  Own  Device  (CYOD) 

In  this  implementation  category,  the  organization  provides  a  portfolio  of  devices, 
and  the  employees  are  given  the  opportunity  to  choose  the  device  they  prefer  (Grajar  et 
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al.,  2013,  p.  64).  This  strategy  capitalizes  on  the  benefits  of  HYOD,  in  that  the  enterprise 
still  has  control  on  the  portfolio  of  devices,  and  not  all  devices  are  allowed.  Additionally, 
the  organization  owns  the  devices  and  still  maintains  the  security  and  access  allowed. 
This  strategy  seeks  to  allow  a  certain  level  of  choice  to  the  individual  employees  to  pick  a 
device  that  they  are  more  comfortable  or  familiar  with,  in  order  to  encourage  employee, 
use  and  efficiency  on  the  device.  Mercado  and  Spain  (2014,  p.  8)  reported  that  the  three 
main  smartphone  types  owned  by  Active-duty  Army  Soldiers  varied  with  age,  with  over 
half  of  all  younger  respondents  in  each  age  group  owning  iPhone  devices,  and  that 
percentage  dropping  steadily  as  age  increased,  with  the  Android  devices  showing  greater 
ownership  by  older  Soldiers.  The  key  take-away  from  their  survey  results  is  that  if  given 
a  choice  no  specific  device  would  satisfy  all  customers;  however,  a  portfolio  of  choices  to 
include  iPhone,  BlackBerry,  and  Android  devices  would  satisfy  the  vast  majority.  This 
strategy  would  mean  additional  cost  to  the  enterprise  in  terms  of  procuring  the  devices,  as 
well  as  additional  cost  in  training  and  staffing  an  IT  department  for  the  capability  of 
maintaining  multiple  CMDs,  operating  systems,  configurations,  etc.  This  cost  is  expected 
to  be  outweighed  by  the  added  benefit  of  allowing  the  employees  to  pick  a  device  they 
are  more  comfortable  and/or  familiar  with. 

c.  Bring  Your  Own  Device  (BYOD) 

In  this  implementation  category,  the  employee  is  either  given  some  amount  of 
financial  resource  (stipend)  or  expected  to  self-procure  a  CMD.  The  key  difference  from 
other  categories  is  the  employee  owns  the  device,  and  is  able  to  install  software  or 
applications  that  are  not  a  violation  of  the  organization  policies.  The  employee  is 
expected  to  maintain  the  device  and  the  enterprise  has  less  control  over  configuration, 
although  it  still  has  the  ability  to  enforce  standards  as  a  pre-requisite  for  network  access 
(Grajar  et  al.,  2013,  p.  64).  The  enterprise  is  still  expected  to  provide  some  support  to  the 
employee  in  terms  of  helping  the  employee  with  configuration,  and  troubleshooting 
hardware-software  issues  that  arise  in  the  use  of  the  device.  This  is  riskier  to  the 
enterprise  network,  because  the  possible  configurations  of  devices  make  the  possibility  of 
network  intrusion  much  higher. 


9 


Naval  Postgraduate  School  (NPS)  uses  a  BYOD  strategy  allowing  students  to 
operate  their  personal  laptops,  tablets,  mobile  phones,  etc.,  on  the  network.  NPS  provides 
support  to  the  students  through  a  self-help  wiki  website  as  well  as  a  full  staff  of  IT 
professionals  who  have  knowledge  of  the  various  operating  systems  and  devices 
commercially  available.  The  students  accessing  the  network  are  responsible  for  procuring 
their  own  device  and  complying  with  usage  standards  as  well  as  maintaining  the  currency 
of  the  anti-malware  software  that  is  provided  to  them.  For  those  students  who  do  not  have 
the  fiscal  means  to  purchase  their  own  device,  the  school  has  a  limited  number  of  devices 
to  be  loaned  out  as  well  as  community  computers  available  throughout  the  campus  in 
computer  labs  and  the  library. 

The  NPS  BYOD  strategy  would  likely  not  work  on  a  wide  scale  in  the  DOD  and 
the  USMC  because  of  the  risk  potential  with  regard  to  personally  identifiable  information 
(PII)  and  unclassified  information  that  is  potentially  sensitive  when  aggregated.  Some  of 
the  potential  methods  of  providing  additional  security  of  a  BYOD 
implementation,  including  the  use  of  applications,  trusted  platform  module  (TPM),  and 
virtual  desktop  infrastructure  (VDI),  will  be  discussed  in  greater  detail  in  this  research. 

cl.  On  Your  Own  Device  (OYOD) 

In  this  implementation  category,  the  employee  is  given  complete  autonomy  on  the 
type  of  and  configuration  of  the  device  used  to  access  the  organizations  network.  Under 
this  category,  the  user  is  responsible  for  management,  maintenance,  upgrade  cycle,  and 
cost  with  no  support  from  the  organization  (Grajar  et  al.,  2013,  p.  64).  “No  support”  is 
not  intended  to  mean  that  the  organization  has  no  IT  personnel;  in  this  case,  the 
organization  maintains  the  network  and  access  to  the  network.  Any  CMD  implementation 
policy  must  be  analyzed  from  the  viewpoints  of  the  enterprise  and  the  employee.  In  some 
DOD  and  USMC  applications,  each  of  these  categories  is  likely  to  apply.  For  example,  in 
the  case  of  USMC’s  Training  &  Education  Command  (TECOM),  an  OYOD 
implementation  plan  could  allow  the  largest  benefit  with  the  least  cost.  In  this  case, 
creating  an  application,  or  even  a  Virtual  Desktop  that  the  user  could  access  from  their 
personally  procured  CMD  in  order  to  complete  computer  based  annual  training  or 
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Military  Occupational  Specialty  (MOS)  training.  This  specific  case  will  be  discussed  in 
greater  detail  in  the  following  chapters  of  this  research. 

C.  INFORMATION  SYSTEMS  STRATEGY  TRIANGLE 

The  Information  Systems  Strategy  Triangle  framework  as  developed  by  Pearlson 
and  Saunders  (2013,  p.  24)  is  an  effective  way  to  analyze  the  interaction  between 
the  business,  organizational  and  information  strategies  in  an  organization.  The  use 
of  the  triangle  is  important,  because  it  shows  how  a  change  in  any  of  the  individual 
strategies  has  effects  on  the  other  strategies.  The  triangle  is  organized  with  the  business 
strategy  at  the  top  of  the  triangle  to  show  that  under  optimal  circumstances  it  will  be 
the  overarching  strategy,  with  the  authors  asserting  that  “successful  firms  have  an 
overriding  business  strategy  that  drives  both  organizational  strategy  and  IS  strategy” 
(Pearlson  &  Saunders,  2013,  p.  24). 


Organizational 

Strategy 


Business 

Strategy 


Information 

Strategy 


Figure  2.  The  Information  Systems  Strategy  Triangle. 

Source:  Pearlson  and  Saunders  (2013,  p.  24). 


Pearlson  and  Saunders  (2013,  p.  27)  define  the  business  strategy  as  “a  plan 
articulating  where  a  business  seeks  to  go  and  how  it  expects  to  get  there.”  For  the  DOD 
this  strategy  comes  down  from  the  president  through  the  National  Security  Council  and  is 
filtered  through  the  echelons  of  command  into  what  individual  organizations  within  the 
DOD  seek  to  accomplish  and  how  they  intend  to  accomplish  their  goals.  The 
organizational  strategy  describes  the  design  of  the  organization,  how  decisions  are  made 

in  the  organization,  how  coordination  is  accomplished,  and  how  the  work  processes  are 
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controlled  (Pearlson  &  Saunders,  2013,  p.  33).  The  DOD  is  recognized  as  highly 
hierarchical  in  its  organization,  but  decision  authority  can  be  de-centralized  in  many 
cases,  and  collaboration  and  liaison  between  entities  in  the  organization  can  vary  greatly 
from  unit  to  unit.  Due  to  this  organizational  complexity,  “one-size-fits-all”  initiatives  do 
not  always  succeed,  and  therefore  individual  organizations  strategies  must  be  considered 
when  analyzing  the  Information  Systems  Strategy  Triangle  for  CMD  implementation. 

The  information  strategy  is  defined  as  “the  plan  an  organization  uses  to  provide 
information  services”  (Pearlson  &  Saunders,  2013,  p.  36).  In  the  DOD,  this  strategy  is 
found  in  various  plans/policies/directives/instructions  as  published  by  the  DOD  CIO  and 
subordinate  CIO’s  or  IT  professionals. 

Misalignments  between  the  two  or  more  points  of  the  triangle  can  lead  to  adverse 
effects  on  the  strategy.  In  Shives  and  Pelz  (2012,  p.  69),  the  authors  looked  at  the  issue  of 
organizational  culture  and  structure,  specifically  the  relationship  between  HQMC  C4  and 
the  acquisition  process  within  the  Marine  Corps  and  how  that  relationship  affects  IT 
changes.  Their  research  ultimately  determined  that  significant  issues  exist  in  the 
relationship  between  HQMC  C4  and  the  organizations  responsible  for  acquisition  of  IT 
resources.  These  authors  specifically  determined  that  while  HQMC  C4  is  responsible  for 
developing  and  implementing  the  information  strategy  from  the  business  strategy  of  the 
Marine  Corps,  HQMC  C4  is  not  formally  included  in  the  acquisition  process  due  to  the 
organizational  strategy.  The  authors  found  that  this  issue  could  lead  to  the  acquisition  of 
information  technology  systems  that  were  not  aligned  with  an  information  strategy  that 
supports  the  business  strategy  (Shives  &  Pelz,  2012,  p.  69).  This  is  an  example  of  how  a 
misalignment  between  the  business  strategy  and  the  organizational  strategy  affects  the 
ability  to  successfully  carry  out  the  information  strategy.  Marine  Corps-specific 
implementation  would  require  policy  change  from  HQMC  C4;  however,  the  structural 
issues,  personnel,  and  political  issues  regarding  acquisitions  could  impact 
implementation.  The  business  strategies,  organizational  strategies,  and  information 
strategies  of  the  DOD  that  are  relevant  to  CMD  are  discussed  in  greater  detail  in  the 
following  section. 
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D.  INFORMATION  SYSTEMS  STRATEGY  AND  POLICY  IN  THE  DOD 

The  United  States  Marine  Corps  (USMC)  and  the  wider  Department  of  Defense 
(DOD)  operate  in  a  resource-constrained  environment  (Nally,  2013).  These  resource- 
constraints  carry  over  into  the  information  technology  (IT)  in  the  form  of  fewer  and  older 
computing  devices.  In  many  cases,  the  number  of  Marines  and  Sailors  in  an  operational 
unit  can  greatly  outnumber  the  computers  and  Internet  connections  assigned  to  that  unit. 
These  computing  devices  vary  in  age  and  capability  from  unit  to  unit.  Equipment 
upgrade  and  replacement  timelines  are  a  function  of  the  budget  cycle  as  well  as  the 
government  acquisition  process.  These  IT  systems  must  be  seen  as  a  capability  multiplier 
that  allows  the  warfighters  to  train,  equip,  and  complete  the  missions  that  support  the 
strategic  focus  of  the  president,  down  to  the  Combatant  Commanders.  The  following  sub¬ 
sections  will  address  the  strategic  focus  as  well  as  the  many  different  directives, 
instructions,  and  memorandums  that  govern  and  direct  the  use  and  implementation  of 
IT  systems  in  the  DOD. 

1.  Current  Strategic  Focus  of  DOD/DON/USMC  Applicability 

The  strategic  focus  of  the  DOD  was  developed  by  the  Joint  Chiefs  of  Staff  (JCS) 
following  a  review  of  the  guidance  that  is  set  down  by  the  president  and  the  National 
Security  Council  (NSC).  These  strategic  focuses  are  intended  to  influence  the  operational 
level  and  tactical  level  focus  in  order  to  achieve  a  strategic  goal  or  end-state.  As  such,  the 
strategic  level  focus  will  not  specify  a  particular  information  technology  strategy  that 
should  be  pursued;  rather,  the  guidance  must  be  derived  through  an  understanding  of  the 
capability  increase  that  certain  elements  of  IT  may  provide.  Connecting  that  potential 
increase  in,  or  added  capability  to,  a  strategic  area  of  focus  is  important  to  justify  the 
allocation  of  resources  to  the  pursuit  of  an  IT  strategy. 

a.  Department  of  Defense  (DOD)  Areas  of  Focus 

The  National  Security  Strategy  as  developed  by  the  president  and  the  National 

Security  Council  lays  down  the  overall  strategic  focus  for  the  country  (White  House, 

2015).  This  strategy  is  then  reviewed  by  the  JCS  and  developed  into  the  National  Military 

Strategy  (Chairman  Joint  Chiefs  of  Staff,  2015).  The  Secretary  of  Defense  (SecDef) 
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developed  the  Quadrennial  Defense  Review  (Secretary  of  Defense,  2014)  in  order  to 
shape  the  focus  of  the  DOD.  In  the  National  Security  Strategy,  the  president  described  the 
focus  as  increasing  security  and  prosperity  through  the  use  of  all  the  resources  of  the 
United  States  government  to  include  the  DOD  (White  House,  2015). 

The  National  Military  Strategy  (2015)  discusses  the  need  to  seize  on  innovation 
and  efficiencies  that  will  allow  the  achievement  of  the  strategic  objectives.  This  strategy 
recognizes  inherent  resource  shortfalls  that  occurred  due  to  budgetary  constraints  as  well 
as  the  vigorous  deployment  cycle  of  the  recent  future.  The  need  for  greater  effectiveness 
and  efficiency  in  order  to  achieve  better  preparation  to  conduct  the  required  missions  of 
the  DOD  is  a  common  theme  of  this  strategy  (Chairman  Joint  Chiefs  of  Staff,  2015).  The 
greater  implementation  and  usage  of  IT  solutions  has  the  potential  to  help  achieve  better 
effectiveness  and  efficiency  for  the  DOD  while  addressing  some  of  the  budgetary 
constraints  that  are  likely  to  occur  into  the  future. 

In  the  Quadrennial  Defense  Review(QDR),  the  SecDef  discusses  many  of  the 
same  issues  as  the  president  and  JCS  such  as  the  need  to  overcome  the  budgetary 
shortfalls  and  achieve  greater  efficiency.  The  QDR  describes  the  need  for  greater 
capability  and  readiness  by  the  DOD  in  order  to  meet  the  strategic  focus,  specifically 
looking  at  modernization  and  a  rebalance  of  the  force  to  decrease  unneeded  infrastructure 
(Secretary  of  Defense,  2014).  A  shift  in  IT  strategy  has  the  potential  to  decrease 
infrastructure,  and  increase  the  effectiveness  and  efficiency  of  the  force  in  the  future. 

b.  Department  of  Navy  (DON)  Areas  of  Focus 

The  previously  discussed  strategies  from  the  DOD  leadership  are  further  digested 
and  developed  into  a  more  Department  of  Navy-focused  strategy,  as  laid  out  in  the 
Cooperative  Strategy  for  21st  Century  Sea  power  (Secretary  of  the  Navy,  2015).  In  this 
strategy,  many  of  the  main  areas  of  focus  from  the  higher  echelon  strategies  are  discussed 
with  a  greater  focus  on  how  the  Navy,  Marine  Corps,  and  Coast  Guard  are  expected  to 
utilize  their  unique  capabilities.  One  main  point  of  this  strategy  is  the  need  to  maintain 
throughout  the  force  a  high  level  of  readiness  to  deploy  rapidly  to  respond  to  crisis. 
Additionally,  this  strategy  prioritizes  affordability  and  cost  control  in  order  to  meet 
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budget  shortfalls  (Secretary  of  the  Navy,  2015).  In  terms  of  adding  capability,  this 
strategy  discusses  the  need  to  capitalize  on  the  strategic  and  intellectual  capital  of  the 
service  members,  which  has  the  potential  to  benefit  from  the  greater  proliferation  of  and 
usage  of  mobile  devices  and  specific  applications  within  the  DOD. 

c.  Marine  Corps  Areas  of  Focus 

In  terms  of  the  strategic  focus  of  the  Marine  Corps,  the  most  recent  plan  is 
Expeditionary  Force  21  (EF21)  (Commandant  of  the  Marine  Corps,  2014).  The  Marine 
Corps  prides  itself  on  being  expeditionary,  amphibious  and  on  the  front  lines  of  any 
conflict  that  arises.  Maintaining  high  readiness  levels,  and  being  prepared  to  deploy  to 
any  point  of  friction  quickly  in  order  to  achieve  the  designated  objectives  is  the  primary 
focus  of  the  Marine  Corps.  EF21  specifically  describes  an  intent  to  improve  training  and 
organization  capability  within  the  Maine  Air  Ground  Task  Force  (MAGTF).  It  also 
specifically  lays  out  the  intent  to  enhance  capability  with  regard  to  social  media, 
information  technology,  and  cyberspace  capabilities  (Commandant  of  the  Marine  Corps, 
2014,  p.  11).  These  areas  of  focus  are,  as  discussed  above,  capable  of  achieving  success 
through  the  implementation  of  CMD  technology  in  the  MAGTF. 

2.  Plans  and  Policies 

In  order  to  understand  the  many  plans,  policies,  directives,  and  instructions  that 
must  be  followed  in  the  implementation  of  any  Commercial  Mobile  Device  (CMD)  that 
may  access  DOD  information  and/or  operate  on  a  DOD  network,  this  research  begins 
with  an  examination  of  the  Federal  Chief  Information  Officer  (CIO)  level  issuances  and 
then  proceeds  down  the  levels  of  command  to  the  Marine  Corps  CIO. 

a.  Federal  CIO 

In  Digital  Government:  Building  A  21st  Century  Platform  to  Better  Serve  the 
American  People  (Federal  CIO,  2012),  the  Federal  CIO  along  with  the  president 
recognize  that  technology,  and  more  specifically  mobile  technology,  is  an  opportunity 
and  a  challenge.  The  Federal  CIO  acknowledged  that  “early  adopters”  within  the 
government  were  working  toward  innovation  in  mobile  usage,  but  that  no  over-arching 
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policy  or  strategy  was  in  place  to  ensure  that  innovations  were  able  to  apply  across  the 
disparate  organizations  of  the  federal  government. 

Digital  Government  (Federal  CIO,  2012)  established  unifying  strategy  objectives 
for  all  of  the  federal  government  to  enable  the  mobile  workforce  to  access  government 
information  “anywhere,  anytime,  on  any  device.”  It  recognizes  “customer-centricity”  and 
“security  and  privacy”  as  two  of  the  major  principles  of  achieving  the  strategy  objectives. 
The  Federal  CIO  explains  that  the  focus  should  be  on  mobility  and  not  necessarily  mobile 
technology  in  this  way: 

Mobility  is  not  just  about  embracing  the  newest  technology,  but  rather 
reflects  a  fundamental  change  in  how,  when,  and  where  our  citizens  and 
employees  work  and  interact.  Mobile  technology-the  devices, 
infrastructure,  and  applications  required  to  support  a  mobile  citizenry  and 
workforce-is  a  critical  enabler  of  mobility,  but  is  only  part  of  the  profound 
environmental  shift  that  mobility  represents.  (Federal  CIO,  2012,  p.  14) 

This  focus  on  mobility  rather  than  the  specific  technology  is  an  important  concept 
that  will  be  discussed  in  greater  detail  in  the  development  of  the  case  studies  for  this 
research. 

b.  Department  of  Defense  (DOD) 

The  Department  of  Defense,  and  more  specifically  the  DOD  Chief  Information 
Officer  (DOD  CIO)  has  the  overall  responsibility  for  the  coordination  of  information 
technology  between  the  organizations  that  make  up  the  DOD.  The  DOD  CIO  issues  the 
plans  and  policies  that  describe  the  development  of  and  use  of  information  technology  to 
meet  the  needs  of  the  greater  DOD.  The  policies  and  instructions  developed  by  the  DOD 
CIO  are  more  generic  in  nature  and  are  intended  to  address  issues  related  to  the 
interoperability  of  DOD  IT  systems  as  well  as  the  confidentiality,  integrity,  and 
availability  issues  common  to  all  subordinate  agencies.  Interoperability  is  recognized  by 
the  DOD  CIO  as  imperative  to  the  successful  implementation  of  any  IT  system  in  the 
current  joint,  interagency,  and/or  multinational  operating  environment  (DOD  CIO,  2014a, 
p.  3).  For  the  purposes  of  this  research,  any  systems  that  “receive,  process,  store,  display, 
or  transmit  DOD  information”  are  considered  DOD  IT  systems  (DOD  CIO,  2014b,  p.  2). 
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(1)  DOD  Commercial  Mobile  Device  Implementation  Plan 

The  DOD  Commercial  Mobile  Device  (CMD)  Implementation  Plan  (DOD  CIO, 
2103)  discussed  the  need  for  a  phased  approach  to  implementing  CMDs  in  the  DOD.  It 
specifically  discussed  the  belief  that  greater  mission  effectiveness  can  be  achieved 
through  the  development  and  proliferation  of  what  it  called  “secure  commercial  mobile 
applications.”  The  plan  goes  on  to  describe  the  four  priorities,  in  terms  of  unclassified 
access,  which  the  DOD  CIO  plans  to  pursue  (DOD  CIO,  2103). 

The  first  is  priority  dealt  with  providing  infrastructure  for  wireless  services.  This 
is  further  described  as  acquiring  contracts  for  carrier  services,  monitoring  and  managing 
the  use  of  those  services,  and  implementing  a  Mobile  Device  Management  (MDM) 
system  to  ensure  maintenance  and  security.  Also  described  is  the  desire  to  consider 
infrastructure  options  that  reduce  costs  “to  the  greatest  extent  possible.” 

The  second  priority  dealt  with  the  need  to  determine  what  devices  can  meet  the 
requirements  threshold,  in  terms  of  capability  and  security,  and  then  to  approve  those 
devices  for  acquisition  and  distribution  to  the  forces. 

The  third  priority  discussed  the  need  for  a  development  and  certification  process 
of  mobile  applications  that  may  access  DOD  information  and  networks,  with  the  main 
focus  of  this  priority  being  the  interoperability  of  applications  with  various  operating 
systems. 

The  fourth  priority  focused  on  the  need  to  protect  and  secure  the  DOD 
information  environment  through  security  approval  processes,  continuous  monitoring  to 
ensure  policy  and  configuration  compliance,  as  well  as  classified  CMD  plans  which  goes 
beyond  the  scope  of  this  research  (DOD  CIO,  2013). 

The  “Future  Capability”  section  of  this  plan  discussed  the  desire  to  possibly 
implement  a  Bring  Your  Own  Device  (BYOD)  style  program  that  is  more  like  the  ones  in 
use  in  the  commercial  business  sector.  It  went  on  to  describe  that  this  future  desired 
capability,  while  possibly  beneficial,  is  prevented  by  DOD  policies  and  the  potential 
security  vulnerabilities.  The  plan  also  described  that  through  the  use  of  Virtual  Desktop 
Infrastructure  (VDI),  or  Trusted  Platform  Module  (TPM)  (either  through  software  or 
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hardware)  the  DOD  may  be  able  to  realize  the  benefits  of  BYOD  in  the  future  (DOD 
CIO,  2013).  This  research  will  go  into  more  detail  on  these  solutions  and  their  possible 
use. 


(2)  DOD  Mobile  Device  Strategy 

In  the  DOD  Mobile  Device  Strategy  (2012,  p.  1),  the  DOD  CIO  recognizes 
mobile  nature  of  the  DOD  workforce.  Mobile  devices  are  recognized  as  improving  the 
productivity,  and  situational  awareness  of  individuals  to  include  members  of  the  DOD. 

The  increasing  use  of  social  media,  smartphones,  and  tablet  computers  has 
made  information  sharing  an  expectation.  Our  challenge  today  is  ensuring 
our  networks  can  securely  support  the  information  demands  of  our  users  - 
users  who  require  access  to  information  anywhere  and  anytime  across  the 
DOD  Information  Enterprise,  allowing  them  to  make  informed  decisions 
in  the  execution  of  their  missions.  (DOD  CIO,  2012,  p.  2) 

This  statement  by  then  DOD  CIO,  Teresa  M.  Takai,  described  the  demand  for 
mobility,  interoperability  as  well  as  security  in  DOD  IT  systems. 

The  first  goal  described  in  this  strategy  discussed  the  need  to  further  develop 
enterprise  infrastructure  to  support  mobile  devices,  which  has  a  potential  to  decrease 
overall  infrastructure  costs  in  terms  of  government  owned  and  furnished  computers  and 
mobile  devices.  Much  like  the  previously  discussed  plan,  this  strategy  recognized  the 
inherent  security  issues  with  mobile  devices  and  the  need  for  Public  Key  Infrastructure 
(PKI)  security  to  control  access  (DOD  CIO,  2012,  p.  3). 

The  second  goal  described  in  this  strategy  recognizes  the  need  for  formalized 
policies  and  standards  governing  the  use  of  mobile  devices  on  the  network.  Recognizing 
that  most  CMDs  are  not  appropriately  equipped  (in  terms  of  security  controls,  access 
protocols,  etc.)  for  use  on  a  DOD  network,  this  strategy  discussed  the  need  for  required 
standards  in  addition  to  a  streamlining  of  the  process  to  approve  CMDs  (DOD  CIO,  2012, 
p.  3).  Central  to  achieving  this  goal,  the  strategy  recognized  the  need  for  appropriate 
workforce  education  and  training  in  order  to  mitigate  potentially  hazardous  employee 
behavior  and  practices. 
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The  third  goal  described  in  this  strategy  is  the  need  for  mobile  and  web-enabled 
applications  to  provide  increased  functionality  to  the  users  (DOD  CIO,  2012,  p.  4).  This 
topic  will  be  discussed  in  greater  detail  in  this  research. 

One  of  the  main  considerations  of  this  implementation  strategy  is  the  need  to 
identify  the  type  of  user  using  the  device  and  the  level  of  access  that  is  required  by  that 
user.  This  research  is  focused  on  Unclassified  Non-Sensitive  information  access  for 
personal  CMD.  User  categories,  the  level  of  access  required,  and  the  considerations  the 
DOD  CIO  recognizes  as  needing  to  be  addressed  in  the  implementation  of  mobile  devices 
are  shown  in  Figure  3. 
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Figure  3.  Implementation  Considerations.  Source:  DOD  CIO  (2012,  p.  6) 
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This  research  will  address  several  of  these  Non-Sensitive  Implementation 
Considerations  at  the  Enterprise- wide  User  Category  level,  recognizing  that  the  current 
state  of  mobile  device  technology  and  the  budgetary  constraints  in  the  DOD  will  have  an 
impact  on  the  overall  strategy. 

c.  Marine  Corps 

The  Marine  Corps  Commercial  Mobile  Device  Strategy  (2013)  is  one  of  the  main 
driving  factors  behind  conducting  this  research.  In  this  strategy.  Headquarters  Marine 
Corps  (HQMC)  established  the  current  approach  regarding  research  and  development 
of  technology  and  policies  to  determine  the  level  of  implementation  that  should  be 
pursued  regarding  the  use  of  personally  procured  mobile  devices.  It  highlights  several 
of  the  currently  understood  issues  with  implementation  as  well  the  anticipated  benefits. 
The  anticipated  benefits  are  limited  and  based  on  an  understanding  of  the  benefits 
other  organizations  have  seen.  This  strategy  also  establishes  the  USMC  definition  of  a 
CMD  as: 

a  handheld  computing  device  with  a  display  screen  that  allows  for  user 
input  (e.g.,  touch  screen,  keyboard).  When  connected  to  a  network,  it 
enables  the  sharing  of  information  in  formats  specially  designed  to 
maximize  the  use  of  information  given  device  limitations  (i.e.,  screen  size, 
computing  power).  (Anderson,  2013,  p.  4) 

This  strategy  additionally  looks  at  the  “way  forward”  for  the  USMC  as 
establishing  a  secure  mobile  framework  (SMF).  It  goes  on  to  specifically  state  developing 
BYOD  as  one  of  the  ways  the  USMC  will  achieve  SMF.  This  strategy  sets  a  goal  of 
establishing  a  mobile  environment  that  allows  personally  owned  CMDs  to  access 
“controlled  unclassified  information  (CUI),”  recognizing  the  potential  benefit  in  terms  of 
“cost  efficiency  and  increased  worker  effectiveness.”  Additionally,  it  recognizes  that 
“legal  ownership  rights,”  and  the  “security  of  the  MCEN”  are  challenges  that  will  need  to 
be  addressed  in  order  for  SMF  to  be  realized  in  the  USMC  (Anderson,  2013,  p.  10). 
Figure  4  graphically  displays  how,  at  a  very  high  level,  the  USMC  will  develop  policy, 
streamline  procurement  and  testing,  develop  mobile  applications  and  mobile 
infrastructure,  all  in  order  to  optimize  operations  (Anderson,  2013,  p.  6). 
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Figure  4.  Secure  Management  Framework,  Source:  Anderson  (2013,  p.  6) 


This  research  is  specifically  intended  to  look  at  the  “Optimize  Operations”  portion 
of  SMF  with  the  assumption  that  mobile  applications  and  infrastructure  can  be  developed 
and  appropriately  secured. 

E.  SOCIOTECHNICAL  SYSTEMS  THEORY 

In  order  to  analyze  the  impact  on  the  DOD  and  USMC  workplace,  the  intersection 
of  the  workforce  and  the  technology  must  be  examined.  One  recognized  method  of 
conducting  this  analysis  is  to  use  the  sociotechnical  systems  (STS)  perspective,  which 
enables  analysis  of  the  organization  (in  this  case  the  DOD,  USMC,  smaller  unit,  etc.) 
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from  a  social  and  a  technical  standpoint  (Bostrom  &  Heinen,  1977).  STS  theory  starts 
with  a  premise  that  “Work  organizations  exist  to  do  work”  and  that  work  involves  people 
(inherently  social  creatures)  and  technology  (computers,  machines,  tools,  etc.)  to 
complete  the  specified  “work”  (Trist,  1981,  p.  10).  STS  theory  recognizes  that 
technological  innovations  are  unlikely  to  be  successfully  integrated  into  an  organization 
unless  the  organization  changes  and  adapts  to  the  new  technology  (Bostrom  &  Heinen, 
1977,  p.  17).  Therefore,  the  worker  and  the  technology  cannot  be  examined  separately, 
but  must  instead  be  analyzed  at  the  intersection  between  the  two  in  order  to  optimize  their 
interaction. 


Social: 
-Attributes  of  individuals 
(attitudes,  values) 
-Relationships  among  peoplel 
-Reward  systems 
-Authority  structure 


Technical: 

-Complexity  of  the  process 
-Interdependence  of  the  tasks 
-Capabilities/Limitations  of  the 
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Figure  5.  Sociotechnical  Systems  Theory.  Adapted  from  Bostrom 

and  Heinen,  (1977,  p.  17). 

STS  theory  can  also  lead  to  an  understanding  of  why  the  DOD  CIO  and 
leadership  within  the  DOD  desires  to  look  into  implementing  policies  that  will  allow 
CMD  in  the  DOD  workplace.  In  Geels  (2004,  p.  911),  the  researcher  determined  that  as 
availability  of  a  technology  increased,  and  as  workers  saw  their  peers  in  other  agencies 
and  organizations  using  the  technology,  a  greater  desire  for  a  similar  capability  in  their 
own  organization  was  present.  Additionally,  the  more  highly  proliferated  the  technology 
was,  the  better  the  understanding  of  and  familiarity  with  that  technology  within  the 
workforce,  and  the  more  that  technology  was  improved  upon  (Geels,  2004,  p.  911). 

Looking  at  a  newly  introduced  technical  innovation  in  the  workplace  from  a 
social  standpoint,  it  can  be  determined  that  the  organization  will  be  made  up  of  at  least 
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some  people  that  do  not  want  the  new  technology  implemented  and  will  either  be  overtly 
or  covertly  resistant  to  the  implementation.  These  individuals  are  usually  in  positions 
within  the  organization  that  will  realize  some  loss  of  status,  budget,  authority,  etc.,  due  to 
the  change.  Trist  (1981,  p.  46)  recognized  that  in  these  situations,  the  optimization  of  STS 
must  address  this  perceived  or  actual  loss  by  these  individuals  with  “sharing  of  power”  in 
order  to  minimize  their  resistance.  This  research  will  use  STS  theory  in  order  to  analyze 
the  CMD  implementation  case  studies  to  determine  the  potential  benefits  and  issues  that 
are  likely  to  arise  from  both  a  social  and  technical  standpoint. 

F.  TECHNOLOGY  ACCEPTANCE  MODEL 

In  addition  to  looking  at  the  optimization  between  the  social  and  technical  aspects 
of  the  organization,  this  research  will  look  at  how  human  behavior  and  individual 
perception  can  impact  the  successful  implementation  of  a  CMD  policy  in  the  USMC.  To 
conduct  this  analysis,  the  Technology  Acceptance  Model  will  be  used,  which  attempts  to 
look  at  how  external  factors  affect  internal  beliefs  and  attitudes  thereby  determining  an 
individual’s  intentions  with  regard  to  adopting  a  technology  (Davis,  Bagozzi,  & 
Warshaw,  1989,  p.  985).  The  two  key  factors  that  will  be  analyzed  in  this  research  are  the 
“Perceived  Usefulness”  and  the  “Perceived  Ease  of  Use,”  and  how  those  two  factors  will 
affect  user  acceptance  of  a  CMD  usage  policy  in  the  individual  case  studies. 

The  extent  to  which  an  employee  believes  a  particular  technology  will  aid  in  the 
performance  of  their  duties  is  referred  to  as  “Perceived  Usefulness,”  and  this  factor  has 
direct  influence  on  how  willing  that  employee  is  to  adopting  and  using  that  technology 
(Davis,  1989,  p.  320).  In  addition  to  this  factor,  is  that  of  “Perceived  Ease  of  Use”  which 
refers  to  the  employee’s  perception  of  how  difficult  the  technology  will  be  to  learn  to 
operate  and  integrate  into  their  performance  of  duties  (Davis,  1989,  p.  320). 
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Figure  6.  Technology  Acceptance  Model.  Source:  Davis  et  al.  (1989,  p.  985). 

This  figure  displays  that  “Perceived  Ease  of  Use”  is  compared  by  the  individual  to 
“Perceived  Usefulness”  and  an  internal  “Cost  Benefit  Analysis”  is  conducted  to 
determine  the  “Attitude  Toward  Using”  that  technology.  This  internal  analysis  by  the 
individual  all  leads  to  the  individual  determining  their  “Behavioral  Intention  to  Use”  and 
that  leads  to  “Actual  System  Use”  by  the  individual  of  that  technology.  The  intent  of  the 
Technology  Acceptance  Model  is  to  look  at  all  of  these  factors  in  order  to  make  a 
reasonable  estimate  of  how  technology  will  be  accepted  or  rejected  by  the  users  within  an 
organization  (Davis  et  al.,  1989,  p.  985).  The  research  conducted  by  Davis  et  al.  (1989, 
p.  997)  determined  that  the  most  influential  factor  is  “Perceived  Usefulness”  in  predicting 
the  individual’s  intention  to  use  a  particular  technology. 

With  this  insight,  the  case  studies  developed  in  this  research,  and  the  policy 
implementation  recommendations  made  will  focus  on  the  maximizing  this  factor  as  well 
as  attempting  to  minimize  the  perceived  difficulty  of  use  in  the  eyes  of  the  individual  that 
is  the  target  “end  user”  for  each  case.  This  research  will  look  at  both  of  these  key  factors 
from  the  perspective  of  the  “end  user”  in  the  case  studies  as  well  as  the  perspective  of  the 
IT  professionals  at  the  unit  and  higher  headquarters  levels. 

G.  CONFIDENTIALITY,  INTEGRITY,  AND  AVAILABILITY  (CIA)  TRIAD 

The  Federal  Information  Security  Management  Act  (FISMA)  of  2002,  established 
the  baseline  definition  of  information  security  as  “protecting  information  and  information 
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systems  from  unauthorized  access,  use,  disclosure,  disruption,  modification,  or 
destruction.”  From  this  definition,  FISMA  (2002)  lays  out  the  three  tenets  of  information 
security,  confidentiality,  integrity,  and  availability,  which  are  commonly  referred  to  as 
the  CIA  Triad,  displayed  in  Figure  7. 


Integrity 


Figure  7.  Confidentiality,  Integrity,  and  Availability  (CIA)  Triad. 

Adapted  from  (FISMA,  2002). 

FISMA  defines  the  three  tenets  of  the  CIA  Triad  as  follows: 

Tenet  1:  Integrity,  which  means  guarding  against  improper  information 
modification  or  destruction,  and  includes  ensuring  information 
nonrepudiation  and  authenticity.  (FISMA,  2002) 

Tenet  2:  Confidentiality,  which  means  preserving  authorized  restrictions 
on  access  and  disclosure,  including  means  for  protecting  personal  privacy 
and  proprietary  information.  (FISMA,  2002) 

Tenet  3:  Availability,  which  means  ensuring  timely  and  reliable  access  to 
and  use  of  information.  (FISMA,  2002) 

These  definitions  provide  the  baseline  for  how  information  security  will  be 
analyzed  with  regard  to  the  case  studies  developed  in  this  research.  The  FISMA 
definition  for  information  security  and  the  sub  tenets  are  fairly  generic.  Malcom  Harkins, 
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Chief  Information  Security  Officer  of  Intel  Corporation  in  2010,  discussed  the  topic 
further  in  his  six  irrefutable  and  unwritten  laws  of  information  security  as  follows: 

Users  want  to  click;  when  connected  to  the  Internet,  people  will  click  on 
things.  Information  wants  to  be  free;  people  are  prone  to  talk,  post,  and 
share.  Code  wants  to  be  wrong;  a  software  program  can  never  be  100  per 
cent  error-free.  Services  want  to  be  on  tap;  some  background  processes 
will  always  have  to  be  switched  on.  Security  features  are  double-edged; 
they  help  and  they  also  harm.  People  set  and  forget;  the  efficacy  of  a 
control  deteriorates  with  time.  In  such  a  context,  compromise  is  inevitable 
for  CIO’s.  (Chandrasekhar,  2013,  p.  2) 

With  the  FISMA  definitions  and  these  “unwritten  laws”  a  basis  for  analysis  and 
evaluation  of  past,  present  and  future  IT  policy  implementations  with  regard  to 
information  security  is  present.  The  individual  case  studies  in  this  research  will  look  at 
specific  CIA  Triad  issues  and  solutions  regarding  specific  implementations  of  CMD  on  a 
government  network.  The  following  sub-paragraphs  will  serve  as  a  brief  discussion  of  the 
research  on  general  CIA  Triad  issues  of  CMD  implementation  and  the  solutions  that 
address  those  issues. 

1.  General  Issues 

In  a  DOD  CIO  Memorandum  (2006),  the  issue  of  the  security  of  unclassified 
sensitive  DOD  data  on  portable  computing  devices  is  recognized  as  a  potential  hazard  to 
confidentiality.  CMD  are  commercially  available  devices  that  are  designed  for  mobility, 
which  makes  them  vulnerable  to  theft  or  loss.  In  a  DOD  CMD  implementation,  the 
device  is  likely  to  connect  to  multiple  wireless  access-points,  including  those  access- 
points  that  are  not  controlled  and  maintained  by  DOD  IT  professionals.  These  access- 
points  could  potentially  provide  opportunities  for  malicious  actors  to  gain  remote  access 
to  a  CMD  and  then,  in  certain  implementations,  gain  access  to  government  networks  and 
data.  The  employees  that  own  and  operate  the  CMD  can  be  targeted  for  phishing,  spam, 
whaling,  downloading  malware,  and  even  intentionally  disclosing  sensitive  government 
information.  Employees  have  done  these  things  on  government  networks  using 
government  equipment,  and  it  can  reasonably  be  expected  that  similar  incidents  are  likely 
to  occur  if  CMDs  are  given  access  to  government  networks.  These  issues  are  the  same  as 
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those  experienced  in  the  commercial  sector  in  implementing  CMD  access  policies.  Using 
some  commercially  available  technology  solutions  as  well  as  well-developed  user 
agreements  and  holding  individuals  accountable  for  their  behavior  has  allowed 
government  organizations  and  commercial  organizations  to  realize  the  benefits  of  CMDs 
in  the  workplace  while  mitigating  many  of  the  risks.  The  key  point  that  needs  to  be 
considered  is  that  the  risks  cannot  be  eliminated  and  the  solutions  described  in  this 
research  are  capable  only  of  managing  and  mitigating  risk  to  an  acceptable  level. 

2.  General  Solutions 

The  key  to  solving  the  CIA  Triad  issues  of  implementing  CMD  in  the  DOD  is  to 
look  at  the  social  and  technical  issues  in  order  to  develop  an  overall  strategy  that 
mitigates  the  risk  of  each.  The  technical  solutions  are  numerous  and  vary  based  on  the 
confidentiality  required  by  law,  and  the  level  of  integrity  and  availability  that  is  required 
to  achieve  success. 

One  of  the  most  common  ways  of  addressing  issues  with  CMD  on  an  enterprise 
network  is  the  use  of  virtualization  technology  to  mitigate  and  compartmentalize  risk  to 
the  enterprise.  In  Jaramillo,  Katz,  Bodin,  Tworek,  Smart,  and  Cook  (2013)  the 
researchers  looked  at  developing  separation  between  the  user  and  the  enterprise  in  order 
to  provide  protection  to  both.  Their  research  looked  at  specific  software  applications  that 
could  be  used  to  provide  this  protection,  as  well  as  what  software  and  hardware 
combinations  worked  best  to  provide  security  to  both  user  and  enterprise.  Virtualization 
technology  has  the  ability  to  allow  the  workforce  to  remotely  access  a  virtual  desktop  on 
the  enterprise  network  and  to  carry  out  their  duties  from  any  location.  Additionally, 
virtualization  has  the  ability  to  prevent  some  of  the  ability  for  DOD  data  to  be  stored  on  a 
personal  CMD.  The  Jaramillo  et  al.  (2013)  research  is  important  in  looking  at  how  the 
DOD  could  appropriately  compartmentalize  access  to  its  networks  in  order  to  more 
securely  allow  limited  CMD  access.  In  Lennon  (2012),  the  researcher  studied  the 
implementation  of  BYOD  at  the  Letterkenny  Institute  of  Technology  in  Ireland.  In  this 
research,  the  author  described  how  Cloud  Computing  was  used  with  BYOD  to  create  a 
Virtual  Learning  Environment.  This  research  is  important  as  a  means  to  understanding 
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what  technology  is  available  to  improve  training  and  education  systems  availability  to  the 
workforce,  which  will  be  addressed  in  a  follow-on  case  study  of  this  research. 

Another  technology  that  has  been  used  to  maintain  information  security  in  an 
environment  in  which  CMDs  are  able  to  access  the  organization  network  is  trusted 
platform  module  (TPM).  Under  this  system,  the  integrity  of  the  device  attempting  to 
access  the  network  is  assessed  and  devices  that  do  not  conform  to  the  established 
standards  in  terms  of  software  installed  and  system  settings  applied  are  denied  access  to 
the  network  (Costantino,  Martinelli,  Saracino,  &  Sgandurra,  2013).  Costantino  et  al. 
(2013)  described  the  use  of  role-based  access  control  systems  in  providing  security.  Their 
research  looked  at  restricting  system  access  based  on  the  user,  and  administrator  set 
permissions.  Establishing  the  restrictions  on  the  user  will  be  essential  in  order  to  provide 
the  needed  security  for  the  Marine  Corps  in  any  implementation  of  using  personally 
procured  mobile  and  computing  devices.  In  Armando,  Costa,  and  Merlo  (2013),  the 
specific  issue  of  securely  implementing  BYOD  with  an  Android  device  was  addressed. 
Their  research  was  limited  to  Android  devices,  which  while  popular  in  the  DOD,  do  not 
represent  the  majority  of  devices  that  DOD  personnel  to  desire  to  connect  to  the  network 
as  shown  by  Mercado  and  Spain  (2014).  TPM  along  with  other  technology  will  likely  be 
needed  in  order  to  appropriately  secure  access  from  CMD  accessing  a  DOD  network. 

The  DOD  currently  uses  the  Public  Key  Infrastructure  (PKI)  technology  in  order 
to  authenticate  users  on  government  furnished  IT  systems.  The  Common  Access  Card 
(CAC)  is  a  device  that  allows  the  workforce  to  access  PKI  enabled  systems,  websites,  etc. 
The  DOD  CIO  Memorandum  (2006)  described  the  use  of  PKI  in  order  to  secure  the 
“Data  at  Rest”  on  personal  CMD. 

Application  based  access  is  another  way  that  the  commercial  sector  uses  to 
compartmentalize  IT  systems  from  the  threats  CMD  access  presents  to  their  networks. 
Intel  Corp.  determined  that  apps  that  made  the  appropriate  data  available  to  the  users  that 
needed  that  data  achieved  the  greatest  success  for  their  company  (Chandrasekhar,  2013, 
p.  4).  For  certain  situations  within  the  DOD,  application-based  access  is  likely  all  that  is 
needed  in  order  to  allow  secure  access  to  a  DOD  network.  In  these  cases,  only  the 
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information  that  is  needed  or  allowed  to  be  accessed  is  displayed  in  the  application 
interface.  The  user  has  limited,  if  any,  ability  to  make  changes  to  the  organization’s  data, 
and  permissions  can  be  tightly  controlled  when  combined  with  other  technological 
means.  The  case  studies  developed  in  this  research  will  look  at  the  potential  for 
application-based  access  to  optimize  operations,  while  mitigating  risk  to  the  network. 

Behavioral  changes  are  necessary  for  the  successful  implementation  of  the  use  of 
CMD.  In  Barkhuus  (2005),  behavioral  issues  were  observed  when  implementing  BYOD 
for  education.  Primarily  this  research  focused  on  the  issue  of  student  attention  when  using 
BYOD  in  an  actual  classroom.  This  research  will  be  applied  to  developing  the 
implementation  plan  for  the  proposed  case  studies.  Additionally,  Intel  Corporation’s  IT 
professionals  raised  the  concern  that  productivity  would  be  negatively  impacted  due  to 
employees  making  the  personal  decision  to  use  their  devices  for  non-work-related 
activities  and  accessing  the  applications  on  the  device  that  provide  no  value  added  to  the 
company  during  work  hours  (Chandrasekhar,  2013,  p.  2).  This  is  a  social  issue  that  will 
need  to  be  addressed  through  training,  and  supervision  by  the  DOD  and  the  USMC  in 
order  to  mitigate  the  risk  that  the  worker  presents  to  the  network. 

During  its  implementation  of  CMD  policies,  Intel’s  research  determined  that  only 
30%  of  its  employees  were  accepting  of  the  company  accessing  the  information  on  their 
personal  devices;  however,  employees  were  almost  unanimously  in  favor  of  Intel 
managing  security  of  their  CMDs  while  also  completing  necessary  training 
(Chandrasekhar,  2013,  p.  3).  Essentially,  the  IT  professionals  tasked  with  spearheading 
any  CMD  implementation  plan  will  need  to  be  aware  of  the  inherent  social/behavioral 
issues.  Appropriate  supervision  and  training,  in  addition  to  technological  safeguards,  will 
help  to  limit  the  CIA  Triad  issues  of  implementing  a  CMD  policy. 

H.  PREVIOUS  CASE  STUDIES  AND  RESEARCH  ON  CMD 

IMPLEMENTATION  POLICY 

The  issues  of  CMD  implementation  have  not  stopped  or  stalled  the  movement  in 
the  commercial  sector,  education,  and  even  some  government  organizations.  Each  of 
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these  examples  shows  how  using  various  technology  and  behavior  policies  have  been 
successful  in  increasing  the  mobility  of  their  end-users. 

1.  CMD  in  Commercial  Sector  (Intel  Corporation) 

In  2010,  Intel  Corporation  had  nearly  80,000  employees  worldwide,  and  nearly 
10,000  of  them  were  already  using  their  personal  CMDs  to  work.  The  Chief  Information 
Security  Officer,  Malcom  Harkins,  was  faced  with  the  challenges  of  determining  how  to 
gain  a  competitive  advantage  from  employees  using  these  devices,  how  to  ensure  the 
security  of  corporate  data,  and  how  to  deal  with  the  ownership  of  Intel  Corp.  data  present 
on  privately  owned  devices  (Chandrasekhar,  2013,  p.  1).  The  DOD  is  wrestling  with 
many  of  these  same  issues  as  Intel  Corp.  in  terms  of  how  CMDs  may  be  used  to  improve 
efficiency,  and  reduce  operating  costs  while  also  addressing  the  potential  security  issues. 

Another  issue  Intel  discovered  was  personal  data  stored  on  a  personal  CMD  used 
at  work  and  the  legal  issues  in  the  event  of  loss,  theft,  or  device  security  compromise. 
Intel  recognized  the  legal  issue  regarding  data  encryption  or  implementing  a  remote-wipe 
capability  on  an  employee’s  CMD  (Chandrasekhar,  2013,  p.  7).  Remotely  wiping  an 
employee’s  device  would  ensure  that  sensitive  company  information  was  safe  from 
exposure;  however,  this  would  also  ensure  that  the  employees’  personal  data  on  that 
device  was  removed.  This  Intel  Corp.  case  study  will  be  used  in  this  research  to  display 
the  struggles  that  are  likely  to  occur  in  implementing  a  CMD  access  policy  in  the  DOD 
and  USMC. 

2.  CMD  in  Government 

Implementing  CMD  access  to  government  networks  is  not  a  new  idea,  but  it  has 
yet  to  be  attempted  on  a  large  scale  in  the  DOD.  Several  government  organizations  have 
developed  policies  for  and  allowed  access  to  their  networks  to  worker-owned  CMDs. 

a.  Alcohol  and  Tobacco  Tax  and  Trade  Bureau  (TTB) 

In  order  to  reduce  costs  in  terms  of  acquisition  and  maintenance  of  workforce 
computing  capability  the  TTB  has  embraced  the  use  of  Virtual  Desktop  Infrastructure 
(VDI)  in  order  to  allow  CMD  usage  (White  House,  2012).  The  TTB  recognized  that  its 
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workforce  was  highly  dispersed,  with  over  80%  teleworking,  at  a  nearly  $2  million  cost 
to  regularly  replace  and  update  their  employees’  desktop  and  laptop  IT  devices  (three-  to 
four-year  replacement  cycle).  TTB’s  implementation  of  VDI  saved  the  organization 
nearly  $1.2  million  in  these  infrastructure  costs,  while  also  increasing  the  mobility  of  its 
workforce.  As  a  result  of  its  implementation  policy,  the  TTB  has  seen  the  program 
expand  to  a  point  where  70%  of  its  personnel  are  using  CMD  to  conduct  their  daily 
duties.  The  main  lessons  learned  from  the  TTB  implementation  are  that  VDI  helps  to 
mitigate  the  financial  risks  associated  with  the  rapid  pace  of  technological  change  in 
CMDs,  as  well  as  insulates  the  organization  by  not  allowing  organizational  data  to  reside 
on  the  personal  device  (White  House,  2012). 

b.  U.S.  Equal  Employment  Opportunity  Commission  (EEOC) 

Similar  to  the  TTB,  the  EEOC  was  under  budgetary  constraints  that  necessitated  a 
shift  in  their  IT  policy.  Their  implementation  policy  focused  on  the  use  of  third-party 
software,  in  the  form  of  mobile  device  management  (MDM)  software,  which  allowed  the 
EEOC  to  enforce  security  settings  and  remotely  wipe  the  devices  in  the  event  of  theft  or 
loss.  This  policy  allowed  their  employees  to  bring  their  personal  CMD  and  access  the 
organization  network  as  long  as  the  user  was  in  compliance  with  an  acceptable  use  policy 
and  the  device  was  in  compliance  with  the  MDM. 

The  EEOC  was  able  to  cut  its  infrastructure  costs  and  increase  the  mobility  of  its 
workforce  through  the  implementation  of  a  CMD  access  policy.  The  main  lesson  learned 
from  the  EEOC  implementation  were  that  legal  counsel  should  be  consulted  early  and 
often  to  protect  the  organization  and  ensure  the  legality  of  any  user  policy  developed 
(White  House,  2012).  This  will  be  important  for  any  DOD  or  USMC  implementation 
policy,  as  the  DOD  is  subject  to  Freedom  of  Information  Act  (FOIA)  requests,  and  other 
government  records  audit  laws. 

c.  State  of  Delaware 

In  dealing  with  an  aging  portfolio  of  BlackBerry  devices,  the  State  of  Delaware 

made  the  transition  from  organization  furnished  devices  to  a  BYOD  program  for  certain 

employees.  Delaware  recognized  that  “many  employees  carry  personal  devices  in 
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addition  to  the  state  issued  device”  and  that  employee  efficiency  and  cost  savings  could 
be  realized  through  allowing  employees  to  use  their  personal  device  for  work. 

The  key  challenges  that  Delaware  faced  included  legal  questions  about  taxability 
of  the  employee  reimbursements  (for  wireless  costs)  as  well  as  the  FOIA  request  issues, 
similar  to  the  TTB  and  EEOC  cases.  These  issues  were  ultimately  addressed  to  a 
satisfactory  level,  and  the  State  of  Delaware  was  able  to  reduce  expenses  related  to 
devices  by  45%.  Delaware  limited  the  reimbursement  program  to  employees  who  are 
“out  of  the  office  on  business  50  or  more  annual  days,”  whose  “duties  require  them  to  be 
contacted  anywhere/anytime,”  and  who  have  “24/7  response  requirements”  (White 
House,  2012).  The  employees  in  this  program  have  similar  job  duty  requirements  to 
many  DOD  employees,  and  therefore  may  be  a  good  target  group  for  the  DOD  in  a  CMD 
implementation  pilot  program. 

The  State  of  Delaware  case  is  particularly  applicable  to  this  research  because  the 
DOD  and,  more  specifically,  the  USMC  are  currently  looking  at  how  to  deal  with  the 
costs  of  an  aging  BlackBerry  device  portfolio.  It  is  important  to  note  that  the  State  of 
Delaware  made  the  BYOD  policy  open  to  all  employees,  but  only  reimbursed  expenses  to 
the  employees  who  met  the  previously  stated  requirements. 

3.  Previous  Research  on  CMD  in  DOD 

Similar  to  the  issues  faced  by  the  previously  described  government  agencies,  the 
USMC  and  the  DOD  in  larger  part  will  need  to  determine  how  best  to  deal  with 
ownership  of  devices,  reimbursement,  FOIA  requests,  remote  device  wiping,  and 
employee  behavior.  In  the  research  done  by  Wedel  and  Michalowicz  (2015),  the 
researchers  looked  at  some  of  the  legal,  technical,  and  security  issues  with  BYOD  in 
terms  of  developing  a  user  policy  that  could  be  used  by  the  Marine  Corps.  Their  research 
was  primarily  focused  policy  issues,  and  looked  at  three  implementations  of  BYOD  in 
government  and  commercial  business  organizations.  It  was  their  determination  that  a 
carefully  crafted  user  agreement  could  protect  the  organization  and  the  individual  while 
realizing  the  benefits  of  BYOD  for  the  workforce  (Wedel  &  Michalowicz,  2015,  p.  91). 
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The  issue  of  policy  and  policy  development  for  incorporating  secure  smartphone 
technology  in  the  USMC  was  researched  by  Epstein  (2014).  Epstein  (2014,  p.  76)  was 
able  to  determine  that  significant  benefits  in  terms  of  efficiency  and  effectiveness  were 
possible  through  the  use  of  a  hypothetical  secure  smartphone  in  a  tactical  situation  for  the 
USMC.  However,  through  analyzing  current  policy  in  the  DOD,  Epstein  (2014,  p.  76) 
determined  that  current  policies  are  unable  to  list  the  vulnerabilities  associated  with  the 
numerous  hardware/software  configurations.  This  results  in  a  potentially  unacceptable 
level  of  risk  with  regard  to  implementing  these  devices,  based  on  the  current  technology 
and  policies.  In  Adkison  (2015),  the  topic  of  mobile  application  development  for  use  on 
CMDs  in  a  tactical  USMC  unit  was  looked  at.  Adkison  (2015)  looked  at  the  utility  of 
enterprise  mobile  applications  for  aviation,  healthcare,  document  management,  as  well  as 
more  military  specific  applications  for  fires,  reporting,  and  information  sharing.  The 
determination  was  that  the  USMC  could  benefit  from  the  use  of  mobile  applications,  and 
that  additional  research  was  needed  in  terms  of  the  security  and  connectivity  of  mobile 
devices  in  a  tactical  environment  (Adkison,  2015,  p.  72).  The  issue  of  smartphones  in 
tactical  situations  is  beyond  the  scope  of  this  research. 

The  gap  in  the  previous  research  is  that  implementing  a  CMD  access  policy  is  an 
information  strategy,  as  described  in  The  Information  Systems  Strategy  Triangle 
framework  developed  by  Pearson  and  Saunders  (2013,  p.  24).  The  research  tends  to  focus 
on  this  one  portion  of  the  triangle;  it  does  not  look  into  how  this  information  strategy  will 
affect  or  be  affected  by  the  business  and  organizational  strategies.  The  previous  research 
seems  to  be  based  on  the  notion  that  the  implementation  of  a  CMD  access  policy  in  the 
Marine  Corps  is  inevitable,  and  the  business  and  organizational  issues  will  need  to  adapt. 

I.  SUMMARY 

The  focus  of  this  research  is  on  better  understanding  the  implications  of  using 
CMDs  in  the  DOD  in  order  to  allow  senior  leaders  within  the  DOD  to  better  determine  if 
these  policies  should  be  pursued,  rather  than  viewing  the  change  as  inevitable.  The 
business  strategy,  organizational  strategy  and  the  informational  strategy  of  the  Marine 
Corps  will  be  analyzed  in  specific  case  studies  to  understand  their  alignment  or  disparity. 
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Using  sociotechnical  systems  (STS)  theory  and  the  technology  acceptance  model  (TAM) 
this  research  will  look  at  these  cases  to  understand  the  potential  issues  of  implementing  a 
new  policy  regarding  CMD  usage  by  the  workforce  as  well  as  potential  solutions  to  those 
issues. 
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III.  METHODOLOGY 


This  research  is  a  series  of  three  qualitative  case  studies  on  the  implications  of 
creating  a  new  information  technology  strategy  within  the  United  States  Marine  Corps 
(USMC)  that  allows  the  use  of  Commercial  Mobile  Devices  (CMD)  by  the  workforce  to 
connect  to  and  interact  with  organizational  data  systems.  The  case  studies  developed  in 
this  research  are  intended  to  address  specific  circumstances  that  would  benefit  the  USMC 
in  terms  of  efficiency  and  effectiveness  of  the  workforce,  while  also  providing  potential 
opportunities  for  cost  savings  in  infrastructure.  Due  to  established  information 
technology  security  policies,  infrastructure  limitations,  and  the  current  state  of  mobile 
device  technology,  it  is  not  possible  to  study  these  cases  directly.  Consequently,  in  order 
to  conduct  this  research,  hypothetical  case  study  methodology  will  be  used. 

The  fundamental  purpose  of  this  research  is  to  create  a  better  understanding  of  the 
potential  issues  and  benefits  the  Marine  Corps  could  reasonably  expect  if  a  conceptual 
policy  allowing  the  use  of  CMDs  in  the  workplace  was  enacted.  Therefore,  the  cases 
developed  for  this  research  are  conceptual  in  nature  and  address  specific  instances  of  the 
conceptual  policy  and  the  implications  at  the  individual,  unit,  and  organizational  levels. 

A.  RESEARCHER  BIAS 

The  researcher  is  biased  toward  technology  solutions  that  decrease  redundancy 
(duplicating  work  in  multiple  systems),  while  simultaneously  increasing  information 
availability  to  those  individuals  that  need  it.  Additionally,  the  researcher  is  biased  against 
solutions  that  place  additional  workload  on  the  end-users  of  the  technology,  preferring 
that  burden  to  be  on  supporting  elements  (contractors,  etc.).  This  bias  comes  from  the 
researcher’s  experiences  and  the  perception  that  technology  solutions  have  been 
implemented  that  seemed  to  only  increase  redundancy  and  increase  the  workload  of  the 
end-user. 
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B.  CMD  IN  MARINE  CORPS  EDUCATION  AND  TRAINING  CASE  STUDY 

(CASE  1) 

Time  to  conduct  training  is  one  of  the  many  resource  limitations  facing  the 
USMC  that  leaders  are  required  to  contend  with  in  order  to  prepare  their  units  for 
deployment.  The  premise  of  this  case  study  is  that  CMD  technology  has  an  ability  to 
increase  availability  of  education  and  training  resources  to  the  individual  Marine.  By 
increasing  availability  of  education  and  training  resources,  this  technology  has  the 
potential  to  allow  leaders  to  more  effectively  and  efficiently  use  this  limited  resource  of 
time.  If  appropriately  implemented  and  integrated  with  Marine  Corps  culture  and  training 
processes,  this  technology  could  positively  impact  overall  training  and  readiness  of  the 
force. 

The  total  number  of  active  duty  personnel  in  the  United  States  Marine  Corps 
varies  slightly  from  month  to  month;  however,  the  current  end-strength  goal  is  182,000 
(Marine  Corps  Concepts  and  Programs — End  Strength,  2015,  Description  section,  para 
1).  In  order  to  maintain  the  total  end-strength.  Marine  Corps  Recruiting  Command 
(MCRC)  must  recruit  talented  candidates  (both  enlisted  and  officer)  to  counter  the 
outflow  of  personnel  due  to  retirements,  resignations,  or  completing  their  contractual 
obligation  and  returning  to  a  civilian  or  reserve  status.  The  Marine  Corps  Recruit  Depots 
(MCRD)  in  San  Diego  and  Parris  Island,  produce  nearly  21,000  and  18,000  new  Marines 
a  year,  respectively  (Marines  Operating  Forces  Presence  Detail  MCRD  Parris  Island  & 
MCRD  San  Diego,  n.d.).  These  new  Marines  generally  serve  a  four-year  contract,  with 
roughly  23%  of  these  first  term  Marines  receiving  an  opportunity  to  re-enlist  for  a  second 
term  (Motley  &  Bird,  2016).  The  result  of  the  high  accession  of  new  recruits  and  low 
retention  opportunities  are  a  high  throughput  of  Marines  every  year. 

1.  Background  and  Organization 

Training  and  education  in  the  Marine  Corps  is  overseen  by  Training  and 
Education  Command  (TECOM),  headquartered  in  Quantico,  VA.  TECOM’s  mission  is 
as  follows: 
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TECOM  is  charged  by  the  Commandant  of  the  Marine  Corps  with  the 
development,  coordination,  resourcing,  execution,  and  evaluation  of 
training  and  education  concepts,  policies,  plans,  and  programs  to  ensure 
Marines  are  prepared  to  meet  the  challenges  of  present  and  future 
operational  environments.  (Training  and  Education  Command,  n.d., 
Mission  section) 

TECOM  is  further  divided  into  two  separate  commands,  Training  Command  and 
Education  Command  (also  referred  to  as  the  Marine  Corps  University  [MCU]).  Training 
Command  conducts  Military  Occupational  Specialty  (MOS)  “individual- skill  training, 
analyzes,  designs,  develops,  resources,  implements,  and  evaluates  standards-based 
individual  training  in  order  to  provide  combat-capable  Marines  and  Sailors  to  the 
operating  forces”  (Training  Command,  n.d.,  para.  1).  MCU’s  mission  is  “to  develop, 
deliver,  and  evaluate  professional  military  education  and  training  through  resident  and 
nonresident  programs  to  prepare  leaders  to  meet  the  challenges  of  the  national  security 
environment”  (Marine  Corps  University  Vision  Statement,  n.d.,  MCU  Mission  Statement 
section). 

Within  MCU  is  the  College  of  Distance  Education  and  Training  (CDET)  whose 
mission  is  to  “design,  develop,  deliver,  evaluate,  manage,  and  resource  distance  learning 
products  and  programs  across  the  Marine  Corps  training  and  education  continuum  in 
order  to  increase  operational  readiness”  (United  States  Marine  Corps  College  of  Distance 
Education  and  Training,  n.d.).  CDET  works  with  a  network  of  regional  centers  (based  on 
Marine  Corps  bases)  to  provide  Professional  Military  Education  (PME)  to  Marines  on 
these  bases.  Additionally,  CDET  maintains  the  online  repository  of  computer-based 
training  for  the  Marine  Corps,  Marine  Corps  Distance  Learning  Network  (MarineNet). 

All  Marines  are  required  to  complete  mandatory  annual  training  through 
MarineNet,  which  is  an  online  system  that  provides  access  to  computer  based  training 
modules.  Fifteen  courses  are  required  to  be  completed  by  every  Marine  annually  with 
topics  ranging  from  Cyber  Awareness,  Operational  Security,  Anti-terrorism  Awareness, 
to  personal  health  and  wellness  training  (MarineNet  Annual  Training  Curriculums  in 
Support  of  MCBul  1500,  2013).  In  addition  to  these  annual  training  requirements, 
MarineNet  offers  courses  (both  mandatory  and  optional)  that  provide  Military 
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Occupational  Specialty  (MOS)  specific  initial  and  follow-on  training,  as  well  as 
Professional  Military  Education  (PME)  courses  that  are  required  for  advancement  at 
various  stages  of  a  Marines  career.  In  total,  MarineNet  offers  over  4,500  computer-based 
training  modules  and  numerous  training  resources  that  are  available  24/7  to  Marines 
provided  they  have  access  to  a  compatible  computer  system  (MarineNet  Tips,  Tools  & 
Practices,  2011). 

According  to  the  MarineNet  Software  Baseline  Requirements  (n.d.),  “To  ensure 
correct  operation  of  audio,  video,  and  interactive  courseware  components,  you  need 
specific  computer  hardware  and  software.”  This  resource  goes  on  to  list  a  number  of 
Windows  operating  systems  and  applications  that  are  required  to  complete  the  computer- 
based  training  modules.  These  baseline  requirements  do  not  mention  compatibility  with 
the  current  Windows  operating  system  (Windows  10)  or  the  previous  operating  system 
(Windows  8).  Additionally,  the  requirements  list  only  one  web  browser  as  compatible, 
Internet  Explorer.  This  requirements  list  does  not  provide  any  information  regarding 
compatibility  with  CMDs. 

The  Marine  Corps  has  approximately  184,000  Active  Duty  Marines  who  require 
regular  access  to  computer-based  training,  and  approximately  39,000  Reserve  Marines 
who  require  periodic  access  (Title  IV — Military  Personnel  Authorizations,  2015). 
Increasing  accessibility  to  this  training  has  the  potential  to  positively  affect  Marine  Corps 
training  and  readiness.  Additionally,  increasing  accessibility  through  devices  that  users 
already  own  and  operate  has  the  potential  to  reduce  the  infrastructure  costs  (in  terms  of 
desktop  and  laptop  computers)  of  the  Marine  Corps.  The  focus  of  this  case  is  on  how 
allowing  CMDs  to  access  Marine  Corps  training  and  education  resources  could 
potentially  provide  benefits  within  an  Infantry  unit  in  a  garrison  training  environment. 

2.  Researcher  Experience 

The  researcher  has  previously  served  in  the  Regimental  Operations  Department  of 
3d  Marine  Regiment,  stationed  at  Marine  Corps  Base  Hawaii  (MCBH)  Kaneohe  Bay, 
Hawaii.  The  researcher  was  assigned  as  the  Assistant  Regimental  Air  Officer.  Due  to 
manpower  shortages,  the  researcher’s  duties  exceeded  the  bounds  of  an  Air  Officer, 


38 


which  normally  include  training  Joint  Terminal  Attack  Controllers  (JTAC)  and  serving  as 
the  Regimental  Commanding  Officers  principal  advisor  on  all  matters  involving  the 
tactical  employment  of  aircraft.  The  researcher  also  was  involved  in  developing, 
scheduling,  coordinating,  and  observing  subordinate  unit  infantry  tactics  training  to 
include  field  exercises,  weapons  training,  as  well  as  annual  required  training.  The 
researcher  has  observed  infantry  units  training  for  and  deploying  to  combat  operations  as 
well  as  joint  and  multi-national  exercises. 

3.  Case  Explanation 

The  observation  of  the  researcher  is  that  Marine  Corps  infantry  units  train  to  a 
diverse  set  of  missions  and  then  deploy  to  accomplish  some,  all,  or  none  of  the  missions 
for  which  they  specifically  trained.  The  Infantry  Training  &  Readiness  Manual 
(Department  of  the  Navy:  Headquarters  United  States  Marine  Corps,  2013)  lists  hundreds 
of  training  events,  along  with  the  performance  standards,  that  infantry  units  are  expected 
to  complete  in  order  to  meet  the  demands  of  deployment.  These  training  events  range 
from  individual  skills,  to  squad/platoon/company/battalion  level  live-fire  events. 

This  manual  does  not  include  additional  training  requirements  such  as  annual 
marksmanship  qualification  training  (generally  two  dedicated  weeks  of  training),  water- 
survival  qualification,  daily  physical  training,  PME,  the  Marine  Corps  Martial  Arts 
Program  (MCMAP),  Chemical  Biological  Radiological  &  Nuclear  (CBRN)  training,  and 
annual  administrative  training.  Additionally,  the  researcher  has  observed  additional 
training  mandated  on  these  units  from  higher  echelons  of  command  that  was  in  reaction 
to  some  incident  or  mandate  outside  of  the  Marine  Corps  (i.e.,  Marine  is  involved  in  an 
incident  with  local  Police  and  an  “All  Hands”  training  is  mandated,  or  Congressional 
leadership  mandates  training  due  to  an  increase  in  reported  sexual  assaults). 

Wong  (2002,  p.  7)  conducted  a  study  in  the  U.S.  Army  to  determine  the  time 
available  to  train  for  an  infantry  company  in  comparison  to  the  training  required  to  be 
conducted  in  a  given  year.  In  any  given  year,  109  of  the  365  days  are  unavailable  for 
training  due  weekends  or  federal  holidays,  resulting  in  only  256  available  training  days 
(Wong,  2002,  p.  7).  Examining  the  required  training  events  and  the  time  required  to 
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complete  each  of  these  events,  Wong  (2002,  p.  7)  determined  that  approximately 
297  days  of  training  were  required.  Of  these  297  days,  it  was  determined  that  254  days  of 
training  were  dedicated  to  mission-related  training  (infantry  skills  training,  etc.),  while 
the  other  43  days  were  dedicated  to  non-mission-related  training  (Wong,  2002,  p.  7).  This 
study  only  looked  at  Army  units;  however,  the  training  requirements  between  the  Army 
and  Marine  Corps  are  potentially  similar  in  terms  of  the  time  to  complete  and  the  ratio  of 
mission-related  to  non-mission-related  training  events.  Additionally,  the  researcher 
observed  instances  where  a  Marine  Corps  infantry  unit  conducted  its  training  on 
weekends  or  holidays.  Every  effort  was  made  to  avoid  this,  however,  and  to  provide 
compensatory  time  during  the  work  week  to  the  affected  personnel  when  possible.  All  of 
these  education  and  training  requirements,  coupled  with  looming  deadlines  to  prepare  the 
Marines  and  their  families  for  the  rigors  of  deployment,  add  to  the  need  for  creative  and 
innovative  solutions  in  time  management. 

It  is  important  to  recognize  that  while  the  unit  itself  may  have  more  training 
requirements  than  it  has  training  days  to  complete  them,  a  particular  individual 
(especially  the  more  junior  Marines)  is  not  likely  to  be  actively  engaged  in  training 
during  the  entire  time  the  unit  is  conducting  a  particular  training  event.  This  allows  the 
opportunity  for  potential  white-space  (free  time,  or  time  not  actively  engaged  in  an  event) 
that  could  be  used  by  a  Marine  to  access  MarineNet  and  complete  PME,  MOS  training, 
language  training,  or  other  annual  training  requirements. 

One  particular  example  of  this  white-space  opportunity  is  annual  marksmanship 
training.  The  researcher  has  observed  this  training  first  hand  numerous  times.  During  this 
training,  windows  of  time  are  present  that  a  Marine  has  completed  a  live-fire  event  and  is 
waiting  for  the  remaining  Marines  to  finish  to  move  on  to  another  stage  of  the  training. 
This  time  can  range  from  15  minutes  to  an  hour  or  more  depending  on  the  number  of 
Marines  training.  The  researcher  observed  that  this  time  is  generally  spent  by  Marines 
conducting  their  “Smoke  break”  or  socializing  with  their  friends.  This  research  is  not 
advocating  that  Marines  not  be  allowed  their  “Smoke-break”  or  socialization  time,  only 
that  in  an  already  crowded  training  schedule  this  time  could  potentially  be  used  for  the 
completion  of  training. 
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The  researcher  observed  that  a  majority  of  these  Marines  own  a  CMD,  usually  a 
smartphone  or  tablet,  which  is  with  them  in  their  backpack  during  this  marksmanship 
training.  These  devices  are  not  allowed  on  the  firing  line,  and  the  researcher  has  observed 
them  being  confiscated  by  range  personnel  due  to  their  unauthorized  use.  This  research  is 
not  advocating  that  Marines  who  are  engaged  in  conducting  other  training  themselves,  or 
are  aiding  other  Marines  in  their  training,  be  distracted  from  their  task  by  using  CMDs  for 
professional  purposes.  Supervision,  both  by  range  personnel  and  the  training  units  Staff 
Non-Commissioned  Officers  (SNCOs)  and  Non-Commissioned  Officers  (NCOs)  is 
critical  in  order  to  ensure  safety  and  quality  training. 

Another  example  of  white-space  in  an  infantry  units’  schedule  is  helicopter 
operations  training.  In  this  training,  a  helicopter  squadron  is  tasked  with  providing  a  static 
aircraft  for  Marines  to  practice  entering  and  exiting  in  a  tactical  manner.  Additionally,  the 
squadron  provides  a  section  (two  aircraft)  to  fly  in  and  out  of  a  landing  zone  allowing  the 
Marines  to  enter  the  aircraft,  fly  a  pre-determined  flight  path,  and  either  land  in  the  same 
zone  or  a  different  zone  and  exit  the  aircraft.  During  this  training,  each  helicopter  is  able 
to  accommodate  one  squad  or  less  per  flight.  According  to  Marine  Corps  Reference 
Publication  (MCRP)  1-10.1  (2016),  a  Marine  Infantry  Rifle  Company  generally  has  9 
squads,  with  the  potential  for  additional  attachment  squads  as  desired  by  the  Battalion 
Commander. 

The  researcher  has  observed  this  training  event,  by  a  company-sized  infantry 
element,  takes  anywhere  from  3-6  hours  to  complete.  During  this  period,  an  individual 
squad  may  go  an  hour  or  more  without  an  aircraft  to  train  with.  This  waiting  period  is 
extended  in  the  event  that  one  or  more  of  the  aircraft  have  mechanical  or  weather-related 
issues  prior  to  or  during  the  scheduled  training  time. 

These  situations  are  only  two  examples  of  periods  of  time  that  could  be  used  for 
training  and  education  of  Marines.  The  issue  is  access  to  the  resources,  more  specifically 
access  to  MarineNet.  Looking  at  the  current  state  of  technology,  several  alternative 
solutions  exist. 
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4. 


Potential  Courses  of  Action 


These  solutions  are  limited  to  the  specifics  of  this  particular  case,  but  the  courses 
of  action  (COA)  have  the  potential  to  be  expanded  for  use  by  other  units  in  the  Marine 
Corps.  These  COAs  will  be  discussed  in  terms  of  the  potential  CMD  implementation 
strategy  categories,  and  Confidentiality,  Integrity,  &  Availability  (CIA)  Triad 
considerations. 


a.  HYOD  with  App-Based  Access  ( Case  1 ,  COA  1 ) 

This  COA  recognizes  that  the  Marine  Corps  may  want  to  ensure  100%  of  Marines 
have  access  to  the  newly  developed  application.  The  Marine  Corps  does  not  currently 
mandate  ownership  of  a  CMD  by  Marines,  and  of  those  Marines  that  do  own  a  CMD,  the 
Marine  Corps  does  not  force  the  usage  of  a  particular  operating  system  on  a  personally 
owned  CMD.  A  HYOD  implementation  strategy  would  allow  the  Marine  Corps  to  select 
a  single  device  (or  group  of  similar  devices)  with  only  one  common  operating  system  and 
then  control  those  devices  in  terms  of  configuration  and  usage.  In  this  case,  the  Marine 
Corps  is  responsible  for  purchasing  the  devices,  managing  the  devices,  providing  wireless 
access  (possibly  even  cellular  access),  and  developing  and  maintaining  the  application. 
The  individual  Marine  is  responsible  for  learning  to  operate  the  device,  maintain 
accountability  of  the  device,  use  the  device  in  accordance  with  appropriate  usage 
guidelines,  and  return  the  device  to  Information  Technology  (IT)  staff  when  requested. 

b.  CYOD  with  App-Based  Access  ( Case  1,  COA  2) 

The  Marine  Corps  could  potentially  use  a  CYOD  implementation  strategy,  which 
is  a  slight  modification  of  the  HYOD  implementation  strategy.  In  this  COA,  the  Marine 
Corps  could  capitalize  on  the  individual  user  familiarity  in  a  particular  operating  system 
by  offering  a  choice  between  (for  an  example)  an  iOS  device  or  an  Android  device.  The 
responsibilities  of  the  Marine  Corps  and  the  individual  are  the  same  as  Case  1,  COA  1. 

c.  BYOD  with  App-Based  Access  ( Case  1,  COA  3) 

This  research  assumes  that  the  majority  of  Marines  have  a  personally  owned 


CMD,  which  is  based  on  the  Mercado  and  Spain  (2014,  p.  7)  research  that  showed  that 
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over  79%  of  Soldiers  in  the  Army  owned  “at  least  one  mobile  device.”  With  this 
assumption,  it  is  suggested  that  the  Marine  Corps  develop  a  MarineNet  application  and 
make  it  available  for  download  on  personally  owned  CMD.  This  application  would  need 
to  be  compatible  with  at  least  the  two  most  popular  mobile  operating  systems  (Android, 
and  iOS),  which  would  allow  access  to  70%  or  more  of  personally  owned  devices 
(Mercado,  &  Spain,  2014,  p.  9). 

This  MarineNet  application  would  need  the  ability  to  authenticate  the  user  using 
at  least  two  factors.  It  is  suggested  that  a  username  and  a  password  be  used  to 
authenticate  each  time  the  user  accesses  the  application.  It  is  also  suggested  that  some 
process  is  established  that  allows  the  Marine  to  download  the  application  initially,  and 
having  a  confirmation  email  sent  to  their  official  email  (@ usmc.mil)  account.  This  email 
would  allow  the  Marine  to  authorize  the  CMDs  media  access  control  (MAC)  address. 
This  could  help  to  prevent  unauthorized  users  from  access  the  application,  helping  to 
enforce  confidentiality  of  the  courseware. 

In  terms  of  availability,  this  research  recognized  that  some  of  these  training  events 
occur  in  remote  field-environment  areas,  and  therefore  wireless  connectivity  may  not  be 
available.  For  the  purposes  of  this  case  study,  the  assumption  is  made  that  the  zone  is  in  a 
location  that  has  cellular  connectivity,  which  would  allow  the  Marines  waiting  to  conduct 
training  the  opportunity  to  connect  to  MarineNet  and  access  the  multitude  of  computer- 
based  training  modules  available.  The  requirement  for  wireless  connectivity  could 
potentially  be  overcome,  if  subsequent  application  updates  allowed  Marines  the  ability  to 
download  courses  from  MarineNet  on  their  CMD.  This  would  also  require  the  ability  for 
the  application  to  update  the  Marines’  training  records  the  next  time  the  application  is 
able  to  connect  to  the  Internet. 

This  COA  allows  the  Marines  to  bring  their  personally  owned  (user  preferred) 
devices  and  connect  to  the  application,  allowing  access  to  training  and  education 
resources.  This  research  recognizes  that  not  all  Marines  own  a  CMD,  and  of  those  who 
do  own  a  CMD,  not  all  of  them  will  be  willing  or  able  to  use  the  application. 
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5.  Case  Summary 

This  case  looked  specifically  at  maximizing  the  availability  of  MarineNet  training 
and  education  courseware  to  Marines  during  periods  of  down-time  in  their  regular 
garrison  training  environment.  The  use  of  CMDs  in  conjunction  with  application  based 
access  could  provide  more  efficient  and  timely  completion  of  computer-based  training  by 
Marines.  While  this  case  looked  only  at  an  infantry  unit  in  the  Marine  Corps,  it  is 
possible  that  other  units  (in  the  Marine  Corps,  and  other  services)  could  potentially 
benefit  from  the  selection  of  any  of  the  previously  descried  COAs.  The  potential 
efficiency  of  application  based  access  on  a  CMD  are  not  limited  to  training  and 
education.  It  is  possible  that  numerous  daily  processes  performed  by  Marine  Corps  units 
could  benefit  from  the  application  of  this  technology. 

C.  CMD  IN  SQUADRON  FLIGHT  SCHEDULE  DEVELOPMENT  CASE 

STUDY  (CASE  2) 

Squadron  flight  schedule  development  and  approval  is  a  complex,  time- 
consuming  process  requiring  collaboration  by  several  individuals.  The  premise  of  this 
case  study  is  that  CMD  technology  has  an  ability  to  increase  collaboration  of  those 
individuals  involved  in  flight  schedule  development.  By  increasing  collaboration,  this 
technology  has  the  potential  to  allow  for  a  more  effective  and  efficient  flight  schedule 
development  by  Marine  Corps  squadrons.  If  appropriately  implemented  and  integrated 
into  the  culture,  and  flight  schedule  development  processes  this  technology  could 
potentially  positively  impact  aviation  mishap  investigations. 

In  the  garrison  training  environment,  the  mission  of  the  Marines  in  a  USMC 
aviation  squadron  can  be  simply  stated  as  “the  safe  execution  of  the  daily  flight 
schedule.”  Each  of  the  individual  departments  that  make  up  the  squadron  (Operations, 
Maintenance,  Logistics,  Safety,  etc.)  has  an  impact  on,  and  input  into  the  development 
and  execution  of  the  daily  flight  schedule.  The  daily  task  of  developing  the  flight 
schedule  can  be  a  complex,  and  time-consuming  process.  Through  the  use  of  CMD 
technology  by  the  Marines  involved  in  this  process,  potential  positive  impacts  could  be 
gained. 
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1.  Background 

For  the  purposes  of  this  research,  the  terms  Naval  Aviation  and  Marine  Corps 
Aviation  are  considered  to  be  synonymous.  Navy  aircraft  and  Marine  Corps  aircraft  are 
all  subject  to  the  rules  and  regulations  of  the  Federal  Aviation  Administration  (FAA), 
Office  of  the  Chief  of  Naval  Operations  (OpNav),  Naval  Air  Systems  Command 
(NAVAIR),  and  Headquarters  United  States  Marine  Corps  (HQMC).  Marine  Corps  pilots 
are  responsible  for  understanding  FAA  regulations,  and  by  following  the  procedures 
described  in  the  OpNav  and  HQMC  sources,  all  flights  are  in  compliance  with  the  FAA 
scheduling  regulations. 

The  Commanding  Officer  authorizes  an  aircrew  to  fly  naval  aircraft  under  his/her 
control  through  physically  signing  the  daily  flight  schedule  (OpNav,  2009).  The  signature 
of  the  Commanding  Officer  on  the  flight  schedule  marks  the  successful  completion  of  a 
complex  process  that  is  usually  carried  out  daily  in  a  squadron.  The  process  of 
developing  the  daily  schedule  can  start  months  in  advance  of  execution,  when  key 
stakeholders  (Operations  Officer,  Maintenance  Officer,  and  Commanding  Officer)  meet 
to  develop  long-term  training  plans.  Prior  to  this  meeting,  the  Operations  Officer 
determines  what  aircrew  training  is  needed  by  the  squadron  in  order  to  prepare  for  the 
next  deployment.  The  Maintenance  Officer  determines  the  state  of  the  aircraft  and 
attempts  to  forecast  their  availability,  taking  into  account  regularly  scheduled 
maintenance  periods.  The  Commanding  Officer  acts  as  the  arbiter  between  the  key 
stakeholders  and  the  result  of  the  meeting  is  a  general  schedule  (usually  a  30-day,  60-day, 
and  90-day  plan)  that  both  the  Operations  and  Maintenance  departments  can  prepare  for. 
For  the  purposes  of  this  research,  this  output  will  be  referred  to  as  the  monthly  flight 
schedule. 

The  researcher  has  observed  this  monthly  flight  schedule  development  from  the 
perspective  of  the  Operations  department  and  the  Maintenance  department.  The  monthly 
flight  schedule  usually  shows  the  number  of  aircraft  that  can  be  scheduled  for  flight 
operations/training  on  a  given  day,  as  well  as  the  number  of  hours  that  those  aircraft  can 
be  flown  during  that  day.  It  is  from  this  information  that  the  Operations  Officer  (OpsO) 

and  the  Pilot  Training  Officer  (PTO)  develop  the  weekly  flight  schedule.  The  weekly 
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flight  schedule  is  used  to  describe  the  expected  takeoff  and  landing  times  of  the  aircraft, 
the  training  events  that  will  occur,  and  the  aircrew  expected  to  fly  those  aircraft. 

The  weekly  flight  schedule  is,  in  general,  written  at  least  one  week  in  advance  and 
must  take  into  account  many  factors.  The  PTO  must  look  at  the  training  that  is  needed  to 
prepare  the  aircrew  of  the  squadron  and  then  match  those  in  need  of  training,  with 
aircrew  instructors  that  are  authorized  to  conduct  the  training.  This  task  is  made  more 
difficult  by  the  individual  schedules  of  the  Marines  in  the  squadron.  The  researcher  has 
observed  one  method  that  PTOs  use  to  accommodate  individual  needs,  called  the  Snivel 
Log.  The  Snivel  Log  is  the  method  by  which  an  individual  Marine  can  communicate  to 
the  PTO  his/her  availability  to  conduct  aircrew  training  on  a  given  day.  The  individual 
Marine  is  expected  to  put  in  periods  of  non-availability  due  to  appointments,  vacation, 
temporary  active  duty  assignment,  or  family  issues. 

With  the  Snivel  Log,  the  PTO  populates  the  weekly  flight  schedule,  and  then  that 
schedule  is  agreed  to  by  the  key  stakeholders  (the  Safety  department  is  added  to  the  key 
stakeholders  at  this  point).  This  provides  the  Maintenance  department  another 
opportunity  to  assess  the  state  of  the  squadron’s  aircraft  and  determine  if  the  previously 
agreed  to  monthly  plan  is  still  supportable.  The  Safety  department  assesses  the  weekly 
flight  schedule  to  ensure  it  is  in  compliance  with  all  OpNav  and  HQMC  rules  and 
regulations  regarding  aircrew  selection  and  assignment.  Finally,  the  Commanding  Officer 
approves  the  weekly  flight  schedule  and  sends  it  back  to  the  PTO,  who  directly  oversees 
the  squadron  schedule  writers. 

The  researcher  has  observed  that  the  monthly  and  weekly  flight  schedules  are 
generally  developed  in  a  spreadsheet  program  (usually  Microsoft  Excel).  The  successful 
completion  of  the  weekly  flight  schedule  results  in  the  schedule  writers  inputting  the 
information  into  the  Marine-Sierra  Hotel  Aviation  Readiness  Program  (M-SHARP).  M- 
SHARP  is  an  online-based  training  management  system  used  for  scheduling  and  logging 
flights  (Department  of  the  Navy:  Headquarters  United  States  Marine  Corps,  2016).  This 
program  stores  the  individual  qualifications  (i.e.,  Night  Vision  Goggle  qualified)  and 
designations  (i.e.,  Night  Vision  Systems  Instructor)  for  squadron  personnel. 
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The  Marine  Corps  mandates  the  use  of  M-SHARP  in  order  to  “plan,  schedule, 
log,  track,  and  manage  all  training  and  readiness  reporting  requirements”  (Department  of 
the  Navy:  Headquarters  United  States  Marine  Corps,  2016,  p.  2-17).  M-SHARP  offers 
the  ability  to  operate  connected  to  the  Internet,  as  well  as  the  ability  to  create  a  self- 
contained  network  (not  requiring  Internet  connection)  for  use  during  deployed  operations. 
This  self-contained  system  is  required  to  be  connected  to  the  Internet  upon  return  from 
deployment  to  update  the  online  system  (Department  of  the  Navy  DON:  Headquarters 
United  States  Marine  Corps,  2016,  p.  2-20). 

The  daily  flight  schedule  is  developed  in  M-SHARP  by  a  qualified  schedule 
writer,  and  then  a  paper  copy  of  the  schedule  is  printed  for  validation  and  concurrence  by 
the  various  departments  as  directed  by  the  Commanding  Officer.  The  researcher  observed 
that  at  a  minimum  the  following  key  stakeholders  validate  and  concur  with  the  daily 
flight  schedule  prior  to  Commanding  Officers  approval:  Operations  Officer,  Maintenance 
Officer,  Aviation  Safety  Officer,  and  Executive  Officer.  The  researcher  has  also  observed 
that  in  special  circumstances,  the  Commanding  Officer  signed  the  daily  flight  schedule 
without  key  stakeholder  validation  and  concurrence. 

Each  of  these  key  stakeholders  has  the  ability  to  make  changes  to  the  schedule 
that  the  schedule  writer  is  then  required  to  fix  in  M-SHARP.  The  schedule  writer  then  re¬ 
prints  and  re-circulates  the  altered  flight  schedule  for  each  key  stakeholder’s  concurrence. 
The  researcher  has  observed  that  this  process  of  revision  and  re-work  consumes  hours  of 
schedule  writer  time  and  effort.  In  a  squadron  with  multiple  schedule  writers,  the 
researcher  has  observed  the  assignment  of  one  schedule  writer  to  inputting  the  weekly 
flight  schedule  into  M-SHARP  and  another  to  the  daily  routing  of  the  next  day’s  flight 
schedule.  In  this  scenario,  the  schedule  writer  begins  the  work-day  with  a  schedule  that 
is  already  prepared  for  routing,  and  then  that  schedule  writer  could  take  an  entire  eight-  to 
10-hour  day  attempting  to  get  the  concurrence  of  all  the  key  stakeholders  in  order  to 
allow  the  Commanding  Officer  to  sign  the  flight  schedule. 

The  researcher  has  observed  many  causes  for  the  duration  of  this  task.  Some  of 

these  causes  are  due  to  aircraft  maintenance  issues,  or  time-critical  personnel  issues  that 

are  unlikely  to  be  avoided.  Other  causes  are  due  to  nature  of  naval  aviation  training  and 
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various  safety  policies  that  affect  the  key  stakeholder’s  ability  to  physically  arrive  for 
duty  before  a  certain  time.  For  example,  if  one  of  the  key  stakeholders  are  assigned  to 
night  flight  training.  OpNav  “crew  rest”  regulations  require  that,  at  a  minimum,  aircrew 
be  given  8  hours  of  “uninterrupted  sleep  time  for  every  24-hour  period”  and  should  not 
be  “scheduled  for  continuous  alert  and/or  flight  duty  in  excess  of  18  hours”  (Department 
of  the  Navy  Office  of  the  Chief  of  Naval  Operations,  2009,  p.  8-15). 

In  order  to  comply  with  these  regulations,  the  researcher  has  observed 
Commanding  Officers  to  use  their  squadron  Standard  Operating  Procedures  (SOP)  to 
enforce  more  stringent  “crew  rest”  planning  factors.  In  these  planning  factors,  the 
researcher  has  observed  the  Commanding  Officer  restrict  aircrew  from  reporting  to  work 
earlier  than  10  hours  prior  to  that  aircrew’s  expected  land  time.  In  the  case  of  night  flying 
training  operations  that  include  flying  until  midnight,  the  aircrew  would  not  be  allowed  to 
report  to  work  earlier  than  1400  that  day.  If  a  member  of  that  aircrew  is  a  key  stakeholder 
in  the  schedule  development  and  approval,  the  schedule  would  wait  until  he/she  reported 
to  work  for  the  day.  This  case  will  look  at  how,  with  additional  functionality  added  to  M- 
SHARP,  the  Marine  Corps  could  potentially  complete  this  process  in  a  timelier  and  more 
efficient  manner. 

2.  Researcher  Experience 

The  researcher  has  four  years  of  experience  in  a  Marine  Corps  CH-53D  “Sea 
Stallion”  squadron,  stationed  on  Marine  Corps  Base  Hawaii,  Kaneohe  Bay,  HI.  The 
researcher  served  as  a  squadron  pilot  with  multiple  instructor  designations  and 
assignments  as  a  squadron  schedule  writer,  assistant  to  the  Operations  Officer,  Aviation 
Safety  Officer  (ASO),  Director  of  Safety  and  Standardization  (DoSS),  and  Assistant 
Aircraft  Maintenance  Officer  (AAMO)  with  the  squadron.  Due  to  this  experience,  the 
researcher  has  been  involved  with  the  flight  scheduling  process  from  every  key 
stakeholder  position  with  the  exception  of  the  Commanding  Officer. 

3.  Case  Explanation 

The  development  and  eventual  Commanding  Officer  approval  of  the  daily  flight 

schedule  is  a  process  that  involves  collaboration  by  numerous  individuals.  The  process  is 
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complex — not  because  it  is  complicated — but  because  numerous  factors  affecting  it  are 
constantly  changing.  For  example,  the  previous  day’s  flying  operations  could  leave  the 
maintenance  department  with  fewer  flyable  aircraft  than  previously  agreed  to.  This 
situation  could  cause  an  entire  schedule  to  be  cancelled,  or  some  reduced  number  of 
events  flown.  Additionally,  aircraft  readiness  or  weather-related  cancellations  of  a  high- 
priority  event  could  cause  a  ripple  effect  that  forces  changes  to  several  subsequent  flight 
schedules.  In  the  researcher’s  experience,  these  issues  are  very  common,  to  the  point  of 
being  routine. 

Often  the  consequences  of  making  changes  to  the  schedule  due  to  these  issues 
leads  to  2nd-  and  3rd-order  effects  that  extend  the  time  for  the  schedule  to  reach 
completion.  For  example,  in  the  case  of  weather  affecting  a  high-priority  event,  the 
researcher  has  observed  the  PTO  may  re-schedule  the  event  and  push  the  previously 
scheduled  event  back  a  day  or  more.  This  change  seems  benign;  however,  the 
consequence  is  the  schedule  is  re-routed  through  all  the  key  stakeholders  again.  During 
this  process,  the  researcher  has  observed  that  aircrew  are  scheduled  for  events  that  they 
are  unable  to  fly  due  to  previously  scheduled  engagements,  as  detailed  in  the  Snivel  Log. 
The  schedule  is  then  returned  to  the  PTO  and  the  schedule  writer  for  further  re-work,  and 
re-routing.  This  process  takes  time,  and  as  each  individual  key  stakeholder  returns  the 
schedule  for  re-work,  the  schedule  must  be  re-routed  to  all  the  key  stakeholders  for  their 
concurrence.  Additionally,  this  time  consuming  and  inefficient  process  is  further  delayed 
if  any  individual  is  prevented  from  reporting  to  work  due  to  crew  rest  considerations. 

CMDs  are,  by  their  nature  highly  portable,  instantly  accessible  and  able  to 
connect  to  the  Internet  (Tucker,  2010,  p.  1).  The  connectivity  and  portability  of  CMDs 
could  allow  the  Marine  Corps  to  overcome  issues  related  to  crew  rest.  This  would  likely 
require  the  Commanding  Officer  to  officially  grant  the  key  stakeholders  an  exemption  (in 
the  squadron  Standard  Operating  Procedures)  regarding  crew  rest  policy  allowing  them  to 
telecommute  (under  circumstances  where  it  is  warranted)  during  their  crew  rest  period. 

These  devices  are  not  currently  given  access  to  the  M-SHARP  system.  M-SHARP 

requires  a  common  access  card  (CAC)  and  a  CAC  reader  in  order  to  access  the  system. 

Additionally,  Internet  Explorer  1 1  is  the  only  web  browser  that  is  stated  to  be  compatible 
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with  M-SHARP,  and  the  user  manual  clearly  states  “attempting  to  use  other  versions  of 
Internet  Explorer  or  other  web  browsers  may  result  in  the  program  not  displaying  or 
functioning  as  intended”  (Marines  Sierra  Hotel  Aviation  Readiness  Program:  Software 
User  Manual,  2016,  p.  xxxv).  Navy  Marine  Corps  (NAVMC)  3500. 14D  (2016), 
mandates  the  use  of  M-SHARP  by  all  aviation  units.  In  order  to  allow  a  CMD  to  access 
M-SHARP,  this  research  has  developed  several  COAs. 

4.  Potential  Courses  of  Action 

These  solutions  are  limited  to  the  specifics  of  this  particular  case.  These  COAs 
will  be  discussed  in  terms  of  the  potential  CMD  implementation  strategy  categories,  and 
CIA  Triad  considerations. 

This  research  assumes  that  the  majority  of  Marines  have  a  personally  owned 
CMD,  but  do  not  have  a  CAC  capability  on  their  devices.  In  this  COA,  the  Marine  Corps 
would  be  required  to  contract  the  development  of  an  application  that  had  access  to  a 
limited  number  of  functions  within  the  M-SHARP  program  by  either  the  developer  of  M- 
SHARP  or  a  third-party  contractor.  M-SHARP,  in  addition  to  the  scheduling  utility,  has 
numerous  functions  that  while  not  subject  to  classification  requirements  are  likely 
sensitive  information.  The  researcher  has  observed  information  regarding  aircrew  training 
and  readiness  levels,  and  personally  identifiable  information  (PII)  has  been  stored  on  the 
M-SHARP  system.  The  application  developed  would  only  need  access  to  specific 
information  (based  on  the  individual  key  stakeholder’s  position)  and  access  to  the 
schedule. 

The  researcher  has  observed  that  M-SHARP  only  allows  one  user  (usually  the 
schedule  writer)  to  view/edit  the  schedule.  This  limits  collaboration  by  the  key 
stakeholders  and  would  not  take  advantage  of  the  connectivity,  and  collaborative 
capability  that  CMDs  allow.  It  is  suggested  that  the  application  incorporate  a  document 
editor  function  that  would  allow  the  schedule  writer  to  share  the  schedule  with  all  the  key 
stakeholders  for  their  review  and  edits  simultaneously.  The  application  should  have  the 
ability  for  the  key  stakeholders  to  make  changes,  add  notes,  as  well  as  a  text-based  chat 
function.  With  an  application  like  this,  the  key  stakeholders  would  have  the  ability  to  see 
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each  other’s  changes  in  near  real  time,  and  make  comments  to  each  other  and  the 
schedule  writer.  The  potential  benefit  of  this  application  is  that  collaboration  would  be 
possible  between  the  key  stakeholders  until  a  satisfactory  product  is  produced  and  ready 
for  the  Commanding  Officer’s  signature. 

a.  HYOD  with  App-Based  Access  ( Case  2,  CO  A  1 ) 

In  a  HYOD  implementation  strategy,  the  Marine  Corps  would  be  responsible  for 
developing  the  application,  providing  a  CMD  to  each  key  stakeholder,  and  procuring 
wireless  contracts  for  the  devices.  The  individual  would  be  required  to  maintain  physical 
security  of  the  device,  and  provide  it  to  the  IT  staff  when  requested  for  updates  and 
configuration  checks.  The  squadron  would  maintain  the  devices,  as  new  people  rotated  in 
and  out  of  the  key  stakeholder  positions.  The  devices  would  likely  be  of  one 
configuration  (operating  system,  security  functions,  etc.).  Additionally,  the  newly 
developed  application  would  only  need  to  allow  access  to  the  government  furnished 
devices. 

b.  CYOD  with  App-Based  Access  ( Case  2,  CO  A  2) 

In  a  CYOD  implementation,  the  Marine  Corps  and  the  individual  would  have  the 
same  responsibilities  as  Case  2,  COA  1.  The  fundamental  difference  would  be  that  the 
Marine  Corps  would  offer  a  choice  in  device  to  either  the  squadron  or  the  key 
stakeholder.  The  intended  benefit  of  CYOD  over  HYOD  would  be  observed  when  the 
user  is  allowed  to  use  a  device  he/she  is  more  familiar  with  (Grajar  et  al.,  2013,  p.  63). 
The  researcher  has  observed  that  individuals  can  transition  in  and  out  of  these  key 
stakeholder  positions  frequently,  and  it  may  be  more  timely  and  cost  efficient  to  allow  the 
squadron  Commanding  Officer  or  IT  staff  to  decide  on  a  mix  of  various  approved  devices 
that  are  distributed.  For  example,  a  squadron  may  be  allotted  six  CMDs,  and  choose  to 
have  four  running  iOS,  and  two  running  Android.  In  this  scenario,  the  potential  exists  that 
some  of  the  key  stakeholders  would  not  be  issued  their  preferred  device.  The  researcher 
has  observed  that  the  majority  of  these  key  stakeholders  are  officers  of  the  rank  0-3  or 
0-4  (with  four  to  20  years  of  commissioned  service),  and  would  likely  adapt  quickly  to 
the  device  with  minimal  adversity. 
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c.  BYOD  with  App-Based  Access  ( Case  2,  CO  A  3) 

In  a  BYOD  implementation,  the  Marine  Corps  could  capitalize  on  the  CMD 
already  owned  by  the  individual  Marine.  The  researcher  has  observed  that  individuals  in 
these  key  stakeholder  positions  usually  owned  their  own  CMD  and  were  familiar  with  the 
operation  of  their  device.  The  Marine  Corps  would  still  be  responsible  for  developing  the 
application,  and  could  possibly  provide  a  stipend  to  offset  the  users  wireless  contract 
costs.  The  Marine  Corps  would  need  to  develop  a  system  of  granting  and  revoking  access 
to  the  application  as  individuals  were  transferred  in  and  out  of  the  key  stakeholder  billets. 

5.  Case  Summary 

This  case  looked  at  the  possibility  of  using  CMDs  to  improve  efficiency  and 
collaboration  in  the  development  of  a  Marine  Corps  aviation  squadron  conducting 
training  in  a  garrison  environment.  Through  application-based  access  to  M-SHARP  by 
the  key  stakeholders  working  on  a  CMD,  the  case  was  made  that  the  process  could 
potentially  be  improved.  This  daily  process  is  common  to  all  Marine  Corps  aviation 
squadrons.  The  potential  exists,  that  a  similar  application  and  CMD  access  could  benefit 
the  daily  flight  scheduling  process  of  other  services  (Army,  Navy,  Air  Force,  &  Coast 
Guard). 

D.  CMD  IN  AVIATION  MISHAP  INVESTIGATION  CASE  STUDY  (CASE  3) 

Conducting  an  aviation  mishap  investigation  is  a  lengthy,  time-consuming  process 
that  involves  extensive  collaboration  by  several  individuals.  The  premise  of  this  case 
study  is  that  CMD  technology  has  an  ability  to  increase  collaboration  and  mobility  of 
those  individuals  involved  in  the  investigation.  By  increasing  collaboration  and  mobility, 
this  technology  has  the  potential  to  allow  for  a  more  effective  and  efficient  investigative 
capability  in  the  Navy  and  Marine  Corps.  If  appropriately  implemented  and  integrated 
into  the  culture,  training,  and  investigative  processes  this  technology  could  potentially 
positively  impact  aviation  mishap  investigations. 

In  a  USMC  aviation  squadron,  aviation  mishaps  can  and  do  occur  at  any  time  of 
the  day  or  night  and  require  immediate  investigation  by  a  several  appointed  experts  in 
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order  to  determine  the  cause  of  the  incident.  Each  of  the  individual  departments  that 
make  up  the  squadron  (Operations,  Maintenance,  Safety,  etc.)  has  either  a  direct  or  an 
indirect  role  in  completing  the  investigation.  Aviation  mishap  investigations  are  a 
complex  and,  in  some  cases,  a  time-consuming  process  for  numerous  individuals.  The 
use  of  CMD  technology  by  the  Marines  involved  in  the  early  and  on-going  stages  of  the 
investigation  could  have  significant  impact  on  the  ability  to  conduct  a  thorough 
investigation  in  a  timely  and  efficient  manner. 

1.  Background 

The  stated  purpose  of  both  a  Navy  and  a  Marine  Corps  aviation  squadron’s 
aviation  safety  program  is  to  “preserve  human  lives  and  material  resources,  thereby,  to 
enhance  readiness”  (Department  of  the  Navy  Office  of  the  Chief  of  Naval  Operations, 
2014).  Aviation  mishap  investigations  are  intended  to  determine  “the  hazard(s)  which 
precipitated  the  mishap  and  to  recommend  remedies  to  prevent  recurrence”  (Senior 
Member  Guide,  2010).  In  the  event  of  an  aviation  mishap,  including  a  naval  aircraft  of 
unmanned  aerial  vehicle  (UAV),  the  squadron  will  execute  the  Pre-Mishap  Plan  as 
developed  by  the  Aviation  Safety  Officer  and  in  accordance  with  Office  of  the  Chief  of 
Naval  Operations  Instruction  (OPNAVINST)  3750. 6S  (Naval  Aviation  Safety 
Management  System). 

For  purposes  of  this  research,  a  naval  aviation  mishap  is  defined  as: 

an  unplanned  event  or  series  of  events,  directly  involving  a  defined  naval 
aircraft  or  UAV,  that  results  in  damage  to  DOD  property;  occupational 
illness  to  DOD  personnel;  injury  to  on  or  off-duty  DOD  military 
personnel;  injury  to  on-duty  DOD  civilian  personnel;  or  damage  to  public 
or  private  property,  or  injury  or  illness  to  non-DOD  personnel,  caused  by 
DOD  activities.  (OpNav,  2014,  p.  3-5) 

Naval  aviation  mishaps  are  classified  based  on  the  severity  of  material  damage 
and  personnel  injury,  as  shown  in  Table  2. 
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Table  2.  Naval  Aviation  Mishap  Severity  Classifications. 

Adapted  from  OpNav  (2014,  pp.  3-14  -  3-15). 


Damage  to  Naval  Aircraft 

Or  Property 

Personnel  Injury 

Max 

Min 

Max 

Min 

Class  A 

None 

$2,000,000 

(or  aircraft  destroyed/missing) 

None 

Fatality, or  permanent  total 
disability 

Class  B 

<  $2,000,000 

>  or  =  $500,000 

<  Class  A  threshold 

Permanent  partial  disability, 
or  3  or  more  personnel 
hospitalized 

Class  C 

<  $500,000 

>  or  =  $50,000 

<  Class  B  threshold 

Nonfatal  injury  or  illness 

(that  results  in  1  or  more  lost  work  day,  not 
including  day  of  injury) 

Class  D 

<  $50,000 

>  or  =  $20,000 

<  Class  C  threshold 

Any  injury 

(greater  than  first  aid) 

Naval  aviation  mishaps  are  further  classified  into  subcategories  relating  to  the 
state  of  the  aircraft  and  the  aircrew  at  the  time  of  the  mishap.  The  first  category  is  a  flight 
mishap  (FM)  which  is  defined  as  a  mishap  where  “there  is  intent  for  flight  and  damage  to 
a  DOD  aircraft  of  UAV  or  the  loss  of  a  DOD  manned  aircraft”  which  includes  any 
mishaps  that  occur  in  flight,  or  during  take-off  and  landing  periods.  The  second  category 
is  a  flight  related  mishap  (FRM),  which  is  defined  as  a  mishap  where  “there  is  intent  for 
flight  and  no  reportable  damage  to  the  aircraft  or  UAV  itself,  but  the  mishap  involves  a 
fatality,  reportable  injury,  or  reportable  property  damage.”  The  third  category  is  an 
aviation  ground  mishap  (AGM)  which  is  defined  as  a  mishap  where  “there  is  no  intent  for 
flight  that  results  in  reportable  damage  to  an  aircraft  or  UAV  or  death  or  injury  involving 
an  aircraft  or  UAV”  (Department  of  the  Navy  Office  of  the  Chief  of  Naval  Operations, 
2014,  pp.  3-15-3-16).  The  category  and  classification  do  not  have  an  impact  on  the 
conduct  of  the  investigation  but  are  provided  in  this  research  to  show  the  wide  range  of 
incidents  that  require  the  convening  of  an  aviation  mishap  investigation. 

Prior  to  a  mishap  occurring,  the  Aviation  Safety  Officer  is  expected  to  have 
developed  a  Pre-Mishap  Plan,  and  given  training  regarding  the  plan  to  the  standing 
members  of  the  Aviation  Mishap  Board  (AMB),  if  not  to  the  entire  compliment  of 
aviators  in  the  squadron  (Department  of  the  Navy  Office  of  the  Chief  of  Naval 
Operations,  2014,  p.  2-8).  For  all  Class  A,  B,  and  C  which  involve  more  than  minor 
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injuries,  mishaps  the  AMB  is  comprised  of  “at  a  minimum,  an  ASO,  a  flight  surgeon,  an 
officer  well-qualified  in  aircraft  maintenance,  and  an  officer  well-qualified  in  aircraft 
operations”  (Department  of  the  Navy  Office  of  the  Chief  of  Naval  Operations,  2014,  p.  2- 
8).  The  AMB  is  headed  by  a  senior  member  (usually  the  squadron  Executive  Officer) 
appointed  by  the  Commanding  Officer,  with  the  exception  of  Class  A  mishaps  (in  this 
case  the  senior  member  is  assigned  from  an  outside  command).  This  is  the  minimum  staff 
on  an  AMB,  and  the  researcher  has  observed  AMBs  that  had  numerous  specialists 
depending  on  the  nature  of  the  incident. 

The  standing  members  of  the  AMB  are,  with  the  exception  of  the  flight  surgeon 
all  pilots  or  flight  officers  who  may  potentially  be  involved  in  the  mishap  (piloting 
aircraft,  eye  witness,  etc.),  which  leads  to  the  need  for  alternates  who  are  also  trained  and 
ready  to  conduct  the  investigation.  Additionally,  in  the  event  of  a  mishap,  the  AMB 
members  may  be  off-duty  and  may  not  be  able  to  immediately  begin  to  conduct  the 
investigation.  The  researcher  has  observed  that  when  a  mishap  occurs,  the  initial  period 
can  be  chaotic  with  numerous  tasks  from  the  Pre-Mishap  Plan  being  executed 
simultaneously.  In  these  circumstances,  the  ASO  has  been  observed  to  not  proceed  to  the 
investigation  site  until  the  initial  tasks  are  completed  (reporting  and  notifications  of 
higher  headquarters  units,  etc.).  The  need  for  the  members  of  the  AMB  to  work 
autonomously  and  collaboratively,  without  the  guidance  of  the  ASO  is  imperative  to 
collecting  the  necessary  evidence  for  the  investigation. 

Following  the  initial  evidence  collection  in  a  mishap  investigation,  it  is  likely  that 
further  evidence  collection  will  be  required.  Witnesses  are  likely  to  be  interviewed  and 
re-interviewed.  Numerous  external  agencies  such  as  weather,  air  traffic  control,  and  local 
law  enforcement  are  likely  to  coordinate  with  and  provide  information  to  the  AMB.  The 
result  of  the  many  disparate  tasks  in  an  investigation  is  that  large  period  of  time  can  pass 
between  AMB  members  meeting  face  to  face.  In  the  Senior  Member  Guide  (2010),  the 
senior  member  is  advised  to  establish  meeting  times,  to  have  each  member  report  on  their 
status,  and  then  set  goals  for  (and  the  time  and  date  of)  the  next  meeting. 

The  researcher  has  observed  the  completion  of  the  AMB  process  in  weeks  for 

more  minor  investigations,  and  in  months  for  more  major  investigations. 
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Interchangeability  of  AMB  members  is  necessary  in  circumstances  where  an  individual 
must  execute  a  permanent  change  of  station  (PCS)  move,  deploy,  or  conduct  a  temporary 
assigned  duty  (TAD).  With  an  appropriately  designed  application  installed  on  a  CMD,  it 
is  possible  that  the  aviation  mishap  investigation  process  could  be  improved. 

2.  Researcher  Experience 

The  researcher  attended  the  Naval  School  of  Aviation  Safety  in  Pensacola,  Florida 
in  2010,  receiving  certification  as  a  qualified  Aviation  Safety  Officer  (ASO).  Following 
completion  of  ASO  certification,  the  researcher  held  the  billet  of  Squadron  Aviation 
Safety  Officer  and  Director  of  Safety  and  Standardization.  The  researcher  has  experience 
as  a  AMB  member  on  multiple  mishap  investigations  that  span  each  of  the  severity 
classifications  (Class  A,  B,  C,  etc.)  and  each  subcategory  (FM,  FRM,  &  AGM). 
Additionally,  the  researcher  has  acted  as  ASO  for  a  mishap  involving  a  different 
squadron  than  the  researcher  was  assigned  to,  due  to  the  involvement  of  that  squadron’s 
ASO  in  the  mishap.  The  researcher  has  experienced  first-hand  the  need  for 
interchangeability  of  AMB  members,  and  collaboration  among  those  members  in  order  to 
complete  the  investigation  in  a  timely  manner. 

3.  Case  Explanation 

Aviation  mishaps  are  an  uncommon  occurrence,  and  in  the  case  of  many 
squadrons  in  the  Navy  and  Marine  Corps,  an  ASO  has  the  potential  to  complete  a  two-  to 
three-year  tour  and  not  experience  a  single  mishap.  The  latest  statistics  from  the  Naval 
Safety  Center  (2016)  show  that  in  the  last  12  months  (July  2015  to  July  2016)  the  Navy 
had  seven  Class  A  (FM)  mishaps  and  12  Class  B  (FM)  mishaps,  while  the  Marine  Corps 
had  six  Class  A  (FM)  mishaps  and  three  Class  B  (FM)  mishaps.  This  equates  to  a  Class  A 
(FM)  mishap  rate  for  the  Navy  of  .82  mishaps  per  100,000  flying  hours,  and  a  Class  A 
(FM)  mishap  rate  for  the  Marine  Corps  of  2.48  mishaps  per  100,000  flying  hours  (Naval 
Safety  Center,  2016).  This  research  is  not  intended  to  suggest  that  CMD  technology 
would  lower  these  mishap  rates,  only  that  the  technology  could  improve  the  ability  to 
conduct  an  investigation  when  necessary. 
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In  the  event  of  a  mishap,  the  first  person  notified  is  the  Marine  assigned  to 
Operations  Duty  Officer  (ODO)  in  the  squadron  ready  room.  This  Marine  is  generally, 
although  not  necessarily,  a  more  junior  aviator  in  the  squadron,  and  is  notified  through  a 
radio  transmission  or  a  phone  call  from  some  external  agency  such  as  air  traffic  control, 
Federal  Aviation  Administration  (FAA),  local  police,  etc.  The  ODO  is  often  responsible 
for  initiating  the  Pre-Mishap  Plan,  and  locating  the  Mishap  Kit,  which  holds  the 
investigation-specific  items  needed  by  the  initial  responders  and  the  AMB.  Often,  the 
members  of  the  standing  AMB  are  not  present  for  duty  at  the  time  of  the  incident  or  are 
involved  in  the  mishap  themselves.  In  these  situations,  the  ASO  or  other  command 
representative  directs  initial  responders  to  the  investigation  site  to  begin  evidence 
collection  (pictures,  materials,  etc.). 

The  researcher  has  observed  that  in  the  event  of  a  mishap,  the  initial  responders 
collect  the  pictures  and  videos  on  their  personal  CMD  or  personal  digital  camera  and 
provide  the  materials  to  the  AMB.  These  photos  can  be  of  a  sensitive  nature,  and  need  at 
least  some  level  of  control  exercised  over  them.  It  is  important  to  note,  that  OPNAVINST 
3750. 6S  (2014)  does  not  consider  these  pictures  and  video  “privileged  information” 
unless  they  are  “staged  by  the  AMB  (i.e.,  photographs  that  are  preplanned  or  posed  to 
illustrate  a  specific  condition  or  situation.”  The  order  also  includes  photographs  that  have 
captions  or  markings  on  them  “indicative  of  the  AMB’s  deliberative  process”  as 
privileged  information.  Privileged  information  is  required  to  be  safeguarded  against 
disclosure  through  “public  release  and  non-safety  uses”  (Department  of  the  Navy  Office 
of  the  Chief  of  Naval  Operations,  2014,  p.  1-28). 

The  Naval  Safety  Center  (NAVSAFECEN)  is  responsible  to  the  Chief  of  Naval 
Operations  (CNO),  for  managing  all  safety  matters  in  the  Navy  and  Marine  Corps 
including  the  Naval  Aviation  Safety  Management  System  (Department  of  the  Navy 
Office  of  the  Chief  of  Naval  Operations,  2014,  p.  1-1).  The  NAVSAFECEN  uses  the 
online  system  Web-Enabled  Safety  System  (WESS)  for  the  electronic  development  and 
submission  of  Safety  Investigation  Reports  (SIREP)  by  Navy  and  Marine  Corps  units. 
The  aviation  mishap  specific  portion  of  this  system  is  called  WESS  Aviation  Mishaps  & 
Hazards  Reporting  System  (WAMHRS). 
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WAMHRS  allows  each  the  AMB  to  store  evidence,  points  of  contact,  general 
information,  and  weather  data  for  reference  throughout  the  investigation.  The  system  is 
also  used  for  each  AMB  member  to  write  their  respective  portion  of  the  SIREP.  Access  to 
WESS  and  WAMHRS  is  controlled  by  the  Commanding  Officer  through  the  ASO,  and 
access  to  the  SIREP  in  the  system  is  further  controlled  by  the  ASO  and  the  AMB  senior 
member.  A  CAC  with  public  key  infrastructure  (PKI)  is  required  to  access  the  system, 
and  the  system  is  only  stated  to  be  compatible  with  the  Internet  Explorer  web  browser 
(Department  of  the  Navy  Office  of  the  Chief  of  Naval  Operations,  2014,  p.  4-1). 

It  is  possible  that  WESS  and  WAMHRS  could  be  updated  to  allow  access  to  a 
wider  range  of  operating  systems  and  web  browsers.  However,  it  may  be  more  beneficial 
to  develop  a  mobile  application  that  could  allow  AMB  members  to  upload  investigation 
materials  to  the  WESS  and  WAMHRS.  Compartmentalizing  and  limiting  access  to  the 
system  through  the  application  could  potentially  improve  the  confidentiality  and  integrity 
of  the  system  while  improving  accessibility.  In  order  to  allow  a  CMD  to  access  WESS 
and  WAMHRS,  this  research  has  developed  several  COAs. 

4.  Potential  Courses  of  Action 

These  solutions  are  limited  to  the  specifics  of  this  particular  case.  These  COAs 
will  be  discussed  in  terms  of  the  potential  CMD  implementation  strategy  categories,  and 
CIA  Triad  considerations. 

This  research  assumes  that  the  majority  of  the  Marines  that  are  assigned  to  (or 
could  be  expected  to  be  assigned  to)  the  AMB  have  a  personally  owned  CMD  that  they 
are  familiar  with  operating.  Additionally,  it  is  assumed  that  WESS  and  WAMHRS  can  be 
made  compatible  with  additional  operating  systems  and  web  browsers.  With  these 
assumptions,  the  following  COAs  were  developed  to  potentially  address  the  availability 
issue  described  in  this  case. 

a.  HYOD  with  App-Based  Access  ( Case  3,  CO  A  1 ) 

In  a  HYOD  implementation  strategy,  NAVSAFECEN  would  be  responsible  for 
contracting  the  development  of  a  mobile  application  that  was  compatible  with  WESS  and 
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WAMHRS.  The  Navy  and  Marine  Corps  would  be  responsible  for  procuring  the  CMDs, 
maintaining  the  CMDs  and  contracts  for  wireless  access.  This  COA  would  allow 
NAVSAFECEN  the  ability  to  restrict  access  to  WESS  and  WAMHRS  on  the  mobile 
application  to  only  those  specific  devices  that  the  government  procured. 

The  Marine  Corps  has  a  limited  CMD  HYOD  implementation  program  that 
allows  “privileged  users”  to  obtain  a  government  furnished  device  if  the  user  is  identified 
as  “being  mission  critical  or  mission  essential”  (Anderson,  2013,  p.  11).  The  researcher 
has  observed  that  in  a  Marine  Corps  aviation  squadron  the  Commanding  Officer, 
Executive  Officer  and  Sergeant  Major  are  often  deemed  “privileged  users”  under  this 
program.  This  COA  could  essentially  be  an  expansion  of  this  program  to  include  the 
standing  members  of  the  AMB.  This  research  suggests  that  the  unit  ASO  be  responsible 
for  these  additional  devices,  and  maintain  them  in  the  units  Mishap  Kit  rather  than 
distribute  them  to  the  standing  AMB  members.  The  ASO  would  then  have  control  over 
the  devices,  and  be  responsible  for  training  the  standing  AMB  members  and  alternates  on 
the  devices  use  in  the  event  of  a  mishap. 

It  is  likely  that  in  an  HYOD  implementation,  only  one  type  of  CMD  would  be 
selected  thereby  reducing  the  necessity  to  make  WESS  and  WAMHRS  compatible  with 
multiple  operating  systems  or  web  browsers. 

b.  CYOD  with  App-Based  Access  ( Case  3,  COA  2) 

In  a  CYOD  implementation,  the  NAVSAFECEN  would  have  the  same 
responsibilities  as  the  previous  COA  with  the  additional  responsibility  of  making  the 
application  compatible  with  multiple  CMD  configurations.  The  Navy  and  Marine  Corps 
responsibility  would  remain  the  same  with  the  additional  responsibility  of  providing 
multiple  CMD  configurations  that  the  individual  or  unit  could  choose  from. 

Similar  to  Case  2,  COA  2,  the  researcher  has  observed  that  standing  AMB 
member  assignment  can  change  frequently,  and  it  may  be  more  timely  and  cost  efficient 
to  allow  the  squadron  Commanding  Officer  or  IT  staff  to  decide  on  a  mix  of  various 
approved  devices  that  are  distributed.  In  this  scenario,  the  potential  exists  that  some  of  the 
AMB  members  would  be  issued  a  device  that  they  are  less  familiar  with.  The  majority  of 
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the  AMB  members  are  officers  of  the  ranks  0-3  through  0-6  (with  four  to  30  years  of 
commissioned  service),  however,  and  would  likely  adapt  quickly  to  the  device  with 
minimal  adversity. 

c.  BYOD  with  App-Based  Access  ( Case  3,  CO  A  3) 

In  a  BYOD  implementation,  the  NAVSAFECEN  would  have  the  same 
responsibilities  as  COA  2.  The  Navy  and  Marine  Corps  would  be  responsible  for  making 
the  application  available  to  individuals  on  their  own  device,  as  well  as  limited  technical 
support.  The  individual  units  would  likely  be  responsible  for  controlling  which 
individuals  have  access  to  their  units  WESS  and  WAMHRS  information.  This  COA 
would  potentially  allow  the  greatest  number  of  people  to  collaborate  on  an  investigation, 
while  limiting  the  cost  to  the  government  to  developing  a  mobile  application. 

It  would  likely  be  the  responsibility  of  the  ASO  to  manage  WESS  and  WAMHRS 
and  only  allow  access  to  individuals  that  are  authorized.  Additionally,  the  ASO  would 
likely  need  the  ability  to  revoke  access  of  an  individual  at  the  completion  of  an 
investigation. 

5.  Case  Summary 

This  case  looked  at  the  possibility  of  using  CMDs  to  improve  collaboration, 
information  availability  and  accessibility  in  order  to  more  efficiently  and  effectively 
investigate  an  aviation  mishap.  This  case  is  applicable  to  all  Navy  and  Marine  Corps 
aviation  units  conducting  an  aviation  mishap  investigation  in  a  garrison  environment 
where  wireless  mobile  access  is  available.  Additionally,  an  appropriately  developed 
application  with  access  to  WESS  and  WAMHRS  could  potentially  benefit  non-aviation 
units  in  the  Navy  and  Marine  Corps  conducting  other  safety  investigations  (non-aviation 
mishaps).  This  is  outside  the  scope  of  this  research  and  would  need  to  be  examined  in 
follow  on  research  to  determine  applicability  to  those  processes. 

E.  SUMMARY 

This  research  has  developed  three  independent  case  studies  involving  the 
implementation  of  CMD  technology  with  mobile  application  based  access  that  have  the 
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potential  to  improve  information  availability  and  accessibility  of  the  end  user.  Each  case 
has  been  presented  with  multiple  course  of  action  for  implementation,  each  with  varying 
risks  and  benefits  from  the  perspective  of  the  end-user,  and  the  organization.  The  cases 
and  their  purposed  courses  of  action  will  be  analyzed  based  on  risk  and  benefits  to  the 
individual  and  the  organization.  In  analyzing  the  risks  and  benefits,  this  research  will 
seek  to  understand  how  the  individual  and  the  technology  are  likely  to  interact  (socio- 
technical  systems  theory)  and  how  likely  the  individual  is  to  accept  the  new  technological 
capability  (using  the  technology  acceptance  model). 
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IV.  ANALYSIS 


The  three  case  studies  developed  in  this  research  examine  scenarios  in  which  the 
United  States  Marine  Corps  (USMC)  could  potentially  implement  commercial  mobile 
device  (CMD)  technology  into  business  processes.  Commercial  sector  businesses  like 
Intel  Corporation  have  utilized  CMD  technology  to  revolutionize  the  way  their 
employees  work,  leam,  socialize,  organize,  and  entertain  themselves.  It  is  possible  that 
this  technology  could  similarly  revolutionize  the  USMC. 

In  research  done  by  Mercado  and  Spain  (2014,  p.  7),  mobile  device  ownership 
was  79%  in  the  U.S.  Army,  with  the  youngest  age  group  (20  years  old  and  under)  at 
94%  ownership,  and  it  is  possible  that  the  USMC  has  similar  levels  of  ownership. 
This  younger  demographic  of  Marines  are  the  future  Non-Commissioned  Officers 
(NCO),  Staff  Non-Commissioned  Officers  (SNCO),  and  junior  and  mid-grade 
commissioned  officers  that  are  at  the  forefront  of  day  to  day  operations  and  training 
in  Marine  Corps  units.  These  younger  Marines  are  considered  “digital  natives”  in  that 
they  were  raised  with  the  Internet,  computers,  mobile  phones  and  digital 
technologies  (Prensky,  2001).  These  “digital  natives”  come  to  the  USMC  pre¬ 
programmed  and  trained  to  operate  on  CMDs.  The  challenge  for  leaders  within  the 
USMC  is  to  determine  how  to  garner  the  benefits  of  using  CMDs  while  limiting  the 
detrimental  security  impacts  these  devices  can  have  on  the  network. 

The  analysis  presented  in  this  research  is  both  general  and  specific.  General  risks 
and  benefits  will  be  analyzed  and  applied  to  the  USMC.  Additionally,  each  individual 
case  will  be  analyzed  independently  with  a  focus  on  Socio-technical  Systems  Theory,  and 
the  Technology  Acceptance  Model.  Within  the  analysis  of  each  individual  case  the 
independent  courses  of  action  (COA)  will  be  analyzed  based  on  the  Confidentiality, 
Integrity,  and  Availability  (CIA)  Triad  risks  and  benefits. 


63 


A.  GENERAL  ANALYSIS  OF  CMD  IMPLEMENTATION  IN  THE  USMC 

Metcalfe’s  Law  described  the  value  of  the  network,  as  seen  by  those  users  on  the 
network,  as  increasing  “as  the  square  of  the  number  of  users:  V  ~  N"”  (Metcalfe,  2013, 
p.26).  Value  as  it  is  seen  here  is  not  necessarily  in  monetary  terms,  but  more  in  utility  of 
the  network  to  serve  its  intended  purpose.  The  researcher  observed  this  law  in  the 
introduction  of  the  Blue  Force  Tracker  (BFT)  to  the  battlefield  in  Afghanistan  during 
Operation  ENDURING  FREEDOM.  The  value  of  the  BFT  to  the  researcher,  as  a  pilot 
operating  in  Afghanistan,  was  minimal  in  the  early  stages  of  the  introduction,  because  a 
relatively  small  number  of  users  were  on  the  network  and  even  fewer  had  enough 
familiarity  with  the  system  to  operate  it.  As  the  BFT  gained  popularity  as  a 
communications  and  situational  awareness  tool,  the  value  of  the  BFT  increased 
exponentially. 

It  is  possible  that  the  greatest  single  benefit  related  to  CMD  usage  in  the  USMC 
would  be  the  increase  in  the  number  of  people  that  would  have  access  to  the  network. 
This  could  allow  these  individuals  to  help  create  value  to  the  Marine  Corps  by  increasing 
their  work  efficiency  and  effectiveness.  Conversely,  this  potential  greatest  benefit  could 
also  be  one  of  the  greatest  sources  of  risk  associated  with  CMD  use.  This  is  due  to  the 
risk  associated  with  increasing  the  number  of  potential  access  points  to  the  network, 
which  increases  the  attack  surface  area  for  individuals  and  organizations  intending  to 
cause  harm. 

Many  of  the  advantages  regarding  CMD  usage  are  closely  tied  to  a  disadvantage 
of  that  usage.  The  benefits  of  CMD  usage  at  work  are  broadly  thought  of  as  falling  into 
three  categories:  reduction  of  IT  procurement  cost,  increasing  employee  productivity,  and 
gaining  an  organizational  competitive  advantage  (Chandrasekhar,  2013,  p.  6).  These  three 
categories  are  used  in  this  research  in  order  to  provide  a  framework  of  general  analysis 
for  implementing  CMD  technology. 
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1. 


Cost  Related  Risks  and  Benefits 


In  the  CMD  implementation  cases  of  the  Alcohol  and  Tobacco  Tax  and  Trade 
Bureau  (TTB),  the  U.S.  Equal  Employment  Opportunity  Commission  (EEOC),  and  the 
State  of  Delaware  each  organization  cited  cost  related  factors  as  a  major  reason  for 
pursuing  their  new  technology  policies  (White  House,  2012).  The  researcher  has 
observed  that  cost  savings  is  a  major  factor  in  an  organization  deciding  to  pursue  CMD 
technology.  In  many  cases,  infrastructure  and  equipment  costs  are  reduced,  while  costs  in 
technical  support  have  been  observed  to  increase. 

a.  Infrastructure  and  Equipment  Related  Savings 

CMD  technology  has  the  potential  to  decrease  the  necessity  of  a  desktop  or  laptop 
computer  in  business  processes.  The  TTB  was  spending  nearly  $2  million  every  three  to 
four  years  to  replace  outdated  desktop  and  laptop  computers.  By  implementing  CMD 
technology  into  their  business  processes,  they  were  able  to  save  $1.2  million  of  that 
$2  million  in  infrastructure  and  equipment  costs  (White  House,  2012).  The  State  of 
Delaware’s  CMD  implementation  resulted  in  a  45%  reduction  in  infrastructure  expenses, 
and  a  15%  reduction  in  wireless  costs  (White  House,  2012).  The  EEOC  had  already 
implemented  CMD  technology  with  their  workforce  and  shifted  from  organizationally 
owned  and  provided  devices  to  employee  owned  devices.  By  providing  a  subsidy  to  their 
employees  for  wireless  service  costs,  they  were  able  to  decrease  their  monthly  costs 
related  to  wireless  service  by  20-30%  (White  House,  2012).  These  are  only  three 
examples  of  an  organization  achieving  infrastructure  savings  by  implementing  CMD 
technology. 

Intel  Corp.  recognized  that  costs  were  reduced  in  terms  of  procurement  of 
devices,  however  they  also  determined  that  costs  increased  elsewhere  due  to  the  necessity 
of  evaluating  devices,  ensuring  proper  configuration,  and  continuing  to  support  these 
devices  (Chandrasekhar,  2013,  p.  2).  The  decrease  in  procurement  costs  is  tied  to  the 
particular  device  implementation  strategy  that  is  selected.  For  instance,  the  here’s  your 
own  device  (HYOD)  system  has  significantly  higher  procurement  costs  but  potentially 
lower  configuration  and  support  costs  when  compared  to  the  more  open  bring  your  own 
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device  (BYOD)  system  which  can  allow  for  almost  no  procurement  cost  on  the 
organization. 

Loss  or  damage  to  desktop  and  laptop  computers  is  another  significant 
infrastructure  cost.  Mobile  computing  devices  are  recognized  as  being  more  susceptible 
to  be  loss,  theft,  and  exploitation  than  laptop  and  desktop  computing  devices  located  in  an 
office  space  (Department  of  Defense  Chief  Information  Officer,  2006).  Allowing 
employees  to  bring  their  own  devices  could  reduce  hardware  loss.  Intel  lost  one  percent 
of  its  laptop  computers  each  year  due  to  employee  carelessness  and  theft  (Chandrasekhar, 
2013,  p.  3).  A  BYOD  implementation  would  reduce  the  monetary  cost  to  the  USMC  in 
the  event  of  a  lost  or  stolen  device,  however  the  cost  associated  with  the  potential  damage 
caused  by  that  stolen/lost  device  being  used  for  nefarious  purposes  could  quickly  offset 
the  savings. 

b.  Technical  Support  Increases 

The  infrastructure  savings  associated  with  CMD  implementation  have  been 
observed  to  cause  increased  technical  support  costs.  Organizations  have  been  observed  to 
see  their  costs  grow  dramatically  due  to  the  need  to  “support  mobile  device  access  to 
organizational  resources  and  to  help  reduce  risks  when,  not  if,  these  devices  are  lost, 
stolen,  or  damaged”  (Harvard  Business  Review  Analytic  Services,  2014,  p.  1).  The  IT 
professionals  that  addressed  the  implementation  of  CMDs  in  Intel  Corp.  were  concerned 
with  the  additional  workload  related  to  providing  support  for  an  increasing  number  of 
different  devices  each  with  differing  configurations,  operating  systems,  and  levels  of 
security  or  encryption  (Chandrasekhar,  2013). 

Any  CMD  implementation  in  the  USMC  could  potentially  increase  the  cost 
related  to  technical  support.  The  USMC  may  need  to  hire  civilian  technical  support  staff 
or  train  more  uniformed  technical  support  staff. 
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c.  Wireless  Contracts 

Wireless  contracts  can  be  expensive,  and  the  costs  related  to  the  USMC  funding 
of  wireless  contracts  for  all  employees  could  have  detrimental  effects  on  the  overall 
budget.  The  necessity  of  the  Marine  Corps  to  provide  some  sort  of  subsidy  to  offset  the 
wireless  contract  costs  to  the  individual  is  likely  to  be  related  to  the  type  of 
implementation  used  and  the  degree  to  which  the  implementation  mandates  use.  If  the 
implementation  allows  employees  the  option  to  use  their  own  device,  the  need  to 
subsidize  the  wireless  contract  cost  could  be  minimized.  However,  mandating  the  use  of 
CMDs  in  a  process  could  potentially  lead  to  a  situation  where  the  USMC  would  be 
required  to  provide  full  funding  for  an  employee’s  wireless  contract. 

In  the  cases  of  TTB,  EEOC,  and  State  of  Delaware  each  organization  was  faced 
with  a  decision  regarding  the  organization  paying  for  employee  wireless  contracts.  If  an 
organization  desires  to  subsidize  the  employees  wireless  contract  costs  they  have  several 
options  ranging  from  paying  the  entire  employee  costs  to  providing  a  regular  fixed 
stipend.  In  the  case  of  the  State  of  Delaware,  the  organization  categorized  users  based  on 
the  mobile  necessity  of  their  job  and  then  determines  that  employee’s  eligibility  for 
wireless  cost  reimbursement.  A  determination  by  the  organization  not  to  compensate  the 
employee  for  wireless  costs  did  not  preclude  that  employee  from  using  their  personal 
CMD  (White  House,  2012).  This  research  recommends  a  similar  policy  in  the  USMC, 
allowing  the  maximum  number  of  employees  to  benefit  while  only  requiring  subsidies  for 
employees  that  require  mobility  in  the  completion  of  their  duties. 

2.  Productivity  Related  Risks  and  Benefits 

The  business  of  defending  United  States  in  an  increasingly  globalized  and 
interconnected  world  is  complex  and  seems  to  become  more  difficult  over  time.  This 
complexity  results  in  DOD  employees  being  required  to  “do  more  with  less,”  which 
results  in  a  desire  to  increase  productivity  and  efficiency.  Extensive  research  has  been 
done  by  psychologists  and  companies  to  determine  if  the  proliferation  of  digital 
communications  devices  is  having  a  positive  or  negative  effect  on  human  productivity. 
Microsoft  Canada  (2015,  p.  6),  conducted  a  study  on  2000  Canadians  of  various  age,  sex, 
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and  technology  use  demographics  and  determined  that  overall,  the  human  attention  span 
has  decreased  from  around  12  seconds  in  the  year  2000  to  eight  seconds,  which  is  slightly 
less  than  the  nine- second  attention  span  of  the  average  goldfish.  The  popularity  of 
smartphones,  tablets,  and  the  constant  connectivity  these  technologies  provide  is  unlikely 
to  decrease,  therefore  it  is  beneficial  to  understand  how  these  devices  can  be  used  to 
increase  productivity  and  how  they  can  be  used  to  distract. 

a.  Increasing  Employee  Productivity 

CMD  implementation  has  the  potential  to  allow  employees  to  connect, 
collaborate,  and  be  productive  at  anytime  from  anywhere  that  has  connectivity.  The 
DOD,  and  more  specifically  the  Marine  Corps  operate  around  the  globe  and  around  the 
clock.  Marines  are  indoctrinated  into  the  mindset  that  they  are  “Marines  24/7.”  This 
mindset  is  intended  to  instill  the  idea  that  the  standards  of  conduct  and  values  of  a  Marine 
are  expected  to  be  adhered  to  at  all  times,  but  in  the  digital  age  it  has  carried  over  into  the 
way  many  Marines  work.  Marines  are  not  explicitly  required  to  have  a  personal  mobile 
phone,  but  the  researcher  has  observed  that  using  a  mobile  phones  email/text/voice 
capability  is  a  primary  means  of  conducting  communications  in  a  garrison  environment. 
This  is  more  common  among  the  “key  billet  holders”  (Commanding  Officer,  Executive 
Officer,  etc.)  who  are  required  to  be  continuously  on-call  to  make  a  decision  or  authorize 
action  upon  notification  through  their  device. 

The  Marine  Corps  has  recognized  the  value  of  CMDs  in  increasing  command  and 
control  when  connected  to  the  Marine  Corps  Enterprise  Network  (MCEN),  but  currently 
limits  the  program  to  only  government  furnished  equipment  (GFE)  and  “privileged  users” 
(Anderson,  2013,  p.  11).  “Privileged  users”  are  limited  based  on  the  size  of  and  budgetary 
authority  of  a  unit,  usually  consisting  of  the  more  senior  “key  billet  holders”  of  the  unit. 
This  leaves  the  remaining  members  of  the  unit  to  connect  through  their  personal  CMD, 
with  no  connectivity  to  the  MCEN,  limiting  their  ability  to  be  productive  outside  of  the 
confines  of  their  workspace.  Armano  (2012)  said,  “it’s  not  about  mobile  as  much  as  it  is 
about  understanding  mobility.”  The  intent  of  any  policy  addressing  CMD  implementation 
needs  to  address  the  idea  of  mobility,  not  necessary  mobile.  “Mobility  means 
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information,  convenience,  and  social  all  served  up  on  the  go,  across  a  variety  of  screen 
sizes  and  devices”  (Armano,  2012). 

Currently,  the  Department  of  Defense  (DOD)  and  USMC  are  heavily  dependent 
on  desktop  computers,  or  laptop  computers  that  must  remain  plugged  into  a  specific 
Ethernet  port,  which  limits  the  mobility  of  the  device  and  ultimately  the  productive 
capability  of  the  employee  tethered  to  that  device.  The  researcher  has  observed  that  the 
mobile  phone  decreased  the  necessity  of  a  land-line  telephone,  and  in  much  the  same 
way,  CMDs  are  decreasing  the  necessity  of  stationary  desktop/laptop  in  the  office. 

Harvard  Business  Review  Analytic  Services  (2014,  p.  2)  research  found  that  85% 
of  employees  regularly  used  their  mobile  phone  for  work  related  activities,  65%  of 
employees  said  BYOD  made  them  more  efficient  at  work,  51%  said  customer  service 
improved,  and  47%  reported  enhanced  employee  satisfaction.  Following  their  BYOD 
implementation,  Intel  Corp.  determined  that  their  employees  averaged  a  57-minute  daily 
increase  in  time  spent  on  company-related  work  (Chandrasekhar,  2013,  p.  6).  The 
researcher  has  observed  CMD  proliferation  and  usage  by  Marines  in  USMC  aviation 
squadrons  and  infantry  units  to  be  similar  to  the  85%  employee  usage  statistic  in  the 
previously  mentioned  study.  The  researcher  has  observed  these  employees  use  their 
devices  to  conduct  their  daily  work,  in  a  limited  capacity  because  of  the  restrictions  on 
connecting  their  device  to  the  MCEN.  Allowing  these  employees  to  access  the  MCEN 
with  CMDs  could  allow  the  USMC  to  see  similar  productivity  and  employee  satisfaction 
gains  to  the  previously  mentioned  study. 

Marines  own  CMDs  and  in  some  circumstances  have  their  device  with  them  in 
the  workplace.  Employers  must  understand  that  their  employees  will  “Interact  with  their 
mobile  device”  an  average  of  150  times  per  day  (Panepinto,  2014).  These  mobile  devices 
have  become  a  primary  interaction  tool  that  affects  how  employees  get  their  news  and 
entertainment,  how  they  learn,  and  how  they  fill  at  least  some  of  their  “white  space”  time 
during  the  day  (Panepinto,  2014).  Designing  enterprise  specific  applications  has  helped 
companies  and  organizations  achieve  enhanced  productivity  (Panepinto,  2014).  The 
Marine  Corps  could  potentially  design  and  develop  Marine  Corps  specific  applications 
and  enhance  employee  productivity. 
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In  practice,  personally  owned  CMDs  have  an  ability  to  provide  access  to  an 
incredibly  large  amount  of  information  that  is  well  above  that  which  is  necessarily 
needed  to  complete  daily  tasks  and/or  be  processed  in  the  time  available  to  complete 
those  tasks.  Rosen  &  Samuel  (2015)  discussed  the  need  to  better  streamline  the 
information  individuals  expose  themselves  to  in  a  given  day  to  only  that  which  is 
necessary  to  complete  the  task  assigned.  This  could  be  difficult  to  accomplish  in  the 
DOD,  where  constant  situational  awareness  on  a  wide  variety  of  tasks  is  often  considered 
necessary  in  order  to  maintain  good  command  and  control.  The  researcher  has  observed 
one  particular  example  of  this  issue  in  the  use  of  the  carbon  copy  (CC)  and  blind  carbon 
copy  (BCC)  Email  capability.  The  use  of  this  capability  has  been  observed  to  fill  an 
individual’s  Email  Inbox  with  messages  that  could  potentially  have  little  value  to  that 
individuals  assigned  tasks  and  provide  an  overload  of  information,  negatively  affecting 
productivity. 

b.  Devices  of  Digital  Distraction 

Allowing  CMD  use  in  the  workplace  has  the  potential  to  result  in  in  decreased 
productivity  through  some  employees  experiencing  a  level  of  distraction  due  to  their 
devices.  “The  constant  availability  of  information  and  entertainment  takes  advantage  of 
our  easily  distracted  minds”  (Evans,  2015).  In  a  study  done  by  Ricoh  Americas 
Corporation  (2014),  over  three-quarters  of  employees  used  their  device  to  check  personal 
emails,  two-thirds  sent  personal  texts,  and  over  one-third  checked  social  media  accounts 
or  played  games  while  at  work.  No  company  or  organization  that  observes  the  results  of 
this  study  is  likely  to  be  pleased  with  the  amount  of  time  that  is  spent  on  non-work 
activities.  This  same  study  described  how  the  younger  workers  (18-34)  were  twice  as 
likely  as  the  next-closest  age  demographic  to  access  social  media  or  games  on  their 
device  during  work  hours  (Ricoh  Americas  Corporation,  2014).  The  uniformed  portion  of 
the  USMC  is  largely  represented  by  this  younger  worker  demographic  (18-34),  and  it 
could  expect  that  allowing  greater  usage  of  CMD  in  the  workplace  may  lead  to  some 
workers  succumbing  to  the  distracting  capability  of  their  devices. 
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Multi-tasking  is  one  way  in  which  employees  attempt  to  achieve  greater 
efficiency  in  their  work  day.  The  evidence  is  not  entirely  supportive  of  this  belief,  in  that 
the  ability  to  effectively  do  two  things  at  the  same  time  is  only  possible  when  one  task  is 
“automatic”  (Rosen  &  Samuel,  2015).  Therefore,  employees  who  believe  they  can 
effectively  pay  attention  in  a  meeting  and  check  their  email  at  the  same  time  are 
potentially  neglecting  one  task  or  the  other,  or  both.  In  the  USMC,  this  issue  could  lead  to 
important  information  being  missed  during  a  meeting,  and  lost  efficiency  due  to  mistakes 
and  re-work. 

CMDs  have  the  ability  to  cause  a  digital  distraction  even  when  the  user  does  not 
actually  interact  with  the  device  (Stothart,  Mitchum,  &  Yehnert,  2015,  pp.  893-897). 
Current  public  service  announcement  campaigns  on  television,  radio,  etc.,  are  concerned 
with  the  increased  rate  of  vehicular  accidents  caused  by  drivers  who  are  distracted  and 
interacting  with  their  devices.  Large  numbers  of  videos  posted  on  websites  like  You  Tube 
show  distracted  device  users  walking  into  fountains  in  public  places  or  other 
embarrassing  and  dangerous  situations.  Stothart  et  al.  (2015,  pp.  893-897)  conducted  a 
study  on  students  at  Florida  State  University  to  determine  the  effect  of  various  device 
notification  stimuli  on  the  participant’s  ability  to  perform  a  task  that  required  sustained 
attention.  In  their  experiment,  they  attempted  to  distract  the  test  subject  with  either  a  text 
message  or  a  phone  call  and  compared  the  results  to  a  control  group.  The  result  of  their 
study  was  that  the  decrease  in  performance  of  their  test  subjects  who  received  calls  or 
texts  was  similar  in  magnitude  to  the  decrease  in  performance  of  distracted  drivers,  even 
when  the  subjects  did  not  actively  interact  with  their  device  (Stothart  et  al.,  2015,  p.  896). 

These  findings  are  applicable  to  the  potential  distractive  capability  of  these 
devices  in  a  USMC  workplace.  The  USMC  could  possibly  anticipate  that  a  mechanic 
working  on  a  difficult  vehicular  maintenance  procedure,  with  his/her  CMD  nearby, 
receives  a  phone  call  that  goes  unanswered,  but  for  a  brief  distracted  second  makes  an 
error  that  is  potentially  costly  or  catastrophic.  Or,  perhaps  a  helicopter  pilot  is  flying  a 
training  mission  and  is  momentarily  distracted  by  the  subtle  vibration  of  an  incoming  text 
to  the  CMD  in  his/her  flight  suit  pocket.  These  devices  have  an  undeniable  ability  to  draw 
attention  away,  both  long-term  and  short-term,  from  essential  tasks. 
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It  is  possible  that  CMD  technology  in  the  workplace  is  both  a  cause  of  digital 
distraction  and  if  appropriately  utilized  a  productivity  tool.  It  should  be  the  goal  of  a 
CMD  implementation  policy  to  recognize  the  distraction  capability  and  address  it  with 
appropriate  expectations  of  employee  behavior.  The  policy  should  also  recognize  the 
finite  nature  of  the  human  attention  span  and  use  the  technology  to  increase  the 
productivity  of  the  workforce.  Evans  (2015)  recommendation  for  overcoming  digital 
distraction  was  to  ensure  that  emphasizing  the  use  of  productivity  enhancing  applications, 
encouraging  employees  to  take  a  break  from  their  devices  during  their  work  day,  and 
disabling  the  notifications  on  their  device  to  decrease  the  distracting  capabilities. 

The  research  done  by  Microsoft  Canada  (2015)  has  interesting  insights  that  show 
how  digital  devices  can  act  as  both  a  productivity  tool  and  a  distraction  device.  For 
instance,  if  the  DOD  or  USMC  desires  to  increase  the  effectiveness  of  annual  training,  it 
would  be  beneficial  to  understand  that  a  prolonged  training  period  on  the  dangers  of 
drinking  and  driving  may  not  be  as  effective  as  putting  a  short  message  and  a  picture  on 
an  Internet  access  “splash  page”  before  employees  are  able  to  access  the  Internet  on  their 
devices.  Microsoft  Canada  (2015,  p.  7)  research  also  showed  that  77%  of  18-  to  24-year- 
olds  reach  for  their  smartphone  “When  nothing  is  occupying  my  attention.”  By 
understanding  this  reality  and  tailoring  training  to  be  conducted  anywhere  at  any  time  on 
any  device  and  for  any  duration,  we  may  be  able  to  see  the  increased  effectiveness. 

3.  Gaining  Organizational  Competitive  Advantage 

The  USMC  does  not  necessarily  have  a  business  competitor  in  the  way 
commercial  organizations  compete  against  each  other  for  market  share.  The  USMC  does 
compete  with  other  organizations  (commercial  sector  and  government)  for  quality 
employees  both  uniformed  and  civilian.  This  research  addresses  the  competitive 
advantage  that  the  USMC  could  gain  in  terms  of  recruiting  and  retaining  a  high  quality 
workforce  by  pursuing  a  CMD  implementation  strategy. 

Any  implementation  of  CMD  technology  that  enables  the  workforce  to  achieve 
mobility  and  the  ability  to  conduct  business  process  from  non-standard  locations  could  be 
seen  as  similar  to  the  DOD  Telework  Policy.  This  policy  recognizes  that  telework 
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policies  “can  serve  as  an  effective  recruitment  and  retention  strategy”  and  “enhance  DOD 
efforts  to  employ  and  accommodate  people  with  disabilities”  (Department  of  Defense, 

2012,  p.  2). 

Gaining  an  organizational  competitive  advantage  must  be  analyzed  over  a  long 
time  period.  It  is  also  the  most  difficult  of  the  benefits  to  monetize,  due  to  the  fact  that  the 
use  of  CMDs  is  seen  as  an  enabler  to  the  human  talent  of  the  organization.  As  employees 
have  the  ability  to  network  more  easily,  and  access  their  work  from  anywhere  at  any  time 
the  company  the  potential  of  those  employees  to  benefit  the  organization  is  likely  to 
increase  (Chandrasekhar,  2013).  One  way  the  USMC  could  gain  a  competitive  advantage 
is  by  developing  a  positive  perception  among  potential  recruits  that  the  Marine  Corps  is  a 
forward  leaning  organization  in  the  area  of  IT. 

Today’s  recruits — your  new  employees — live  on  their  mobile  devices. 
They’re  going  to  judge  you  by  how  well  your  company  allows  them  to 
live  on  them  as  well.  With  competition  for  tech  talent  at  an  all-time  high 
and  mobile  tech  savviness  a  common  characteristic  of  new  employees, 
demonstrating  that  your  org  “gets”  the  new  IT  landscape  is  incredibly 
important.  (Panepinto,  2014) 

The  Marine  Corps  could  benefit  from  recognizing  the  nature  of  their  future 
employees  and  their  concerns  and  desires  with  regard  to  their  future  employer. 
Implementing  CMD  technology  into  Marine  Corps  business  processes,  and  increasing  the 
mobility  of  the  workforce  could  make  the  organization  a  more  attractive  place  for  high 
quality  employees  to  work,  which  would  potentially  lead  to  a  long  term  competitive 
advantage. 

4.  General  Analysis  Summary 

Any  implementation  of  CMD  technology  in  the  USMC  is  likely  to  have  risks  and 
benefits  from  the  standpoint  of  the  organization  and  the  individual.  Assessing  the  cost, 
productivity,  and  competitive  advantage  related  risks  and  benefits  is  a  good  starting  point 
for  analyzing  CMD  implementation.  The  key  to  successful  implementation  of  this 
technology  is  in  analyzing  the  specific  technology,  how  it  is  intended  to  be  incorporated 
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into  the  business  processes,  and  mitigating  the  risks  in  order  to  better  understand  specific 
risks  and  benefits. 


B.  CASE  1  ANALYSIS 

In  the  background  and  explanation  of  case  study  1,  the  use  of  CMD  technology 
was  presented  as  a  potential  means  of  addressing  resource  limitations  and  improving  the 
efficiency  of  training  and  education  in  Marine  Corps.  This  case  focused  on  the  capability 
to  fill  potential  “white  space”  in  a  unit’s  schedule  by  increasing  the  availability  of 
computer  based  training  modules.  The  use  of  CMDs  in  an  educational  environment  is 
more  commonly  referred  to  as  “mobile  learning”  and  is  defined  as  “the  exploitation  of 
ubiquitous  handheld  technologies,  together  with  wireless  and  mobile  phone  networks  to 
facilitate,  support  and  enhance  and  extend  the  reach  of  teaching  and  learning”  (Brown, 
2010). 


1.  Sociotechnical  Systems  Theory  Analysis 

The  key  to  determining  the  degree  in  which  the  benefits  will  be  realized  in  any 
implementation  requires  analysis  of  the  intersection  of  the  new  technology  and  the 
workforce.  In  order  to  accomplish  this  analysis,  this  research  uses  Sociotechnical 
Systems  (STS)  theory.  A  key  part  of  this  theory  recognizes  that  a  technology  change  in 
the  organization  is  unlikely  to  succeed  without  a  corresponding  change  in  that 
organizations  workforce. 

In  terms  of  the  social  impact  on  the  organization  of  implementing  this  technology, 
it  is  unlikely  that  the  authority  structure,  and  the  relationships  among  people  would 
change  (Bostrom  &  Heinen,  1977).  Using  an  application  to  access  training  and  education 
resources  from  a  CMD  does  not  require  the  Marine  Corps  to  restructure  its  hierarchal 
organization.  In  the  limited  implementation  of  this  case,  interpersonal  relationships  would 
change  only  in  that  collaboration  in  certain  training  situations  could  be  accomplished 
electronically  rather  than  face  to  face.  The  “reward  system”  in  terms  of  rewarding  the 
Marines  for  completing  their  training  already  exists.  Assuming  that  all  Marines  desire  to 
be  promoted  to  the  next  higher  rank,  the  system  already  rewards  Marines  with  points 
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towards  promotion  (junior  enlisted  Marines),  and  promotion  boards  give  consideration  to 
those  Marines  that  actively  pursue  education. 

Possibly  the  greatest  social  impact  of  implementing  this  technology  in  Case  1  is 
the  minor  changes  in  the  attitudes  and  values  that  would  be  necessary.  Marines  would  be 
required  to  demonstrate  the  maturity  to  use  the  devices  for  training  and  education  during 
working  hours,  and  not  use  them  to  look  at  social  media  or  play  games.  This  could  result 
in  greater  reliance  on  SNCOs  and  NCOs  to  supervise  their  Marines  use  of  these  devices. 
Requiring  these  Marines  to  focus  on  supervision  rather  than  their  own  training  and 
education  will  then  result  in  those  SNCOs  and  NCOs  being  required  to  spend  time 
outside  of  their  normal  working  hours  to  complete  their  own  training  and  education.  This 
is  not  significantly  different  from  what  the  researcher  has  observed  currently  takes  place 
in  the  Marine  Corps. 

In  terms  of  technical  impact  on  the  organization,  this  case  assumes  that  the 
Marine  Corps  has  the  ability  to  develop  a  user  friendly  mobile  application  that  provides 
access  to  computer  based  training  and  resources.  Potential  difficulties  with  regard  to 
limiting  access  to  only  those  individual  authorized  could  create  a  situation  in  which  the 
application  is  too  difficult  to  access.  Additionally,  the  issue  of  updating  an  individual 
Marine’s  training  record  could  add  complexity  to  the  system.  MarineNet  currently  allows 
Marines  to  take  courses  online  and  then  automatically  updates  their  individual  training 
record.  In  an  environment  where  the  application  has  access  to  the  Internet,  this  is  less  of 
an  issue.  However,  if  the  application  has  the  ability  to  download  training  and  resources  to 
the  CMD  and  complete  the  training  in  an  offline  mode  then  the  application  will  need 
some  means  of  updating  MarineNet  during  a  subsequent  application  to  server  connection. 

This  case  and  the  corresponding  courses  of  action  will  have  limited  socio- 
technical  implications  due  to  the  similarity  between  the  current  state  of  the  process  and 
the  process  following  the  implementation  of  CMDs  in  order  to  increase  training  and 
education  availability.  A  larger  issue  for  this  case  will  be  the  acceptance  of  the 
technology  at  the  end  user  level. 
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2.  Technology  Acceptance  Model  Considerations 

Case  1  involves  increasing  the  availability  of  the  computer  based  training 
modules  that  the  Marines  already  complete  through  desktop  or  laptop  computers.  This 
research  makes  the  assumption  that  these  Marines  desire  to  complete  their  required 
training,  and  become  more  proficient  in  their  particular  specialty  within  the  Marine 
Corps.  The  two  key  factors  in  assessing  the  acceptance  of  the  technology  by  the  end  user 
are  “Perceived  Usefulness”  and  “Perceived  Ease  of  Use”  (Davis  et  al.,  1989). 

In  terms  of  perceived  usefulness,  the  end  user  must  make  a  personal  decision 
regarding  how  useful  he/she  believes  the  new  technology  to  be.  If  the  assumption  is  made 
that  the  individual  Marine  desires  to  become  more  proficient  in  their  specialty  and  desires 
to  be  promoted,  then  usefulness  of  this  technology  should  be  relatively  high.  Case  1 
proposes  increasing  availability  of  training  and  education  resources  to  allow  the 
individual  the  ability  to  more  easily  complete  their  required  training.  The  issue  in  terms 
of  acceptance  of  the  technology  will  be  whether  or  not  the  individual  believes  the 
usefulness  outweighs  any  negative  factors  in  terms  of  the  ease  of  use  of  the  technology. 

The  perceived  ease  of  use,  will  be  impacted  by  the  quality  of  the  application  itself 
and  the  course  of  action  (COA)  implemented.  This  research  assumes  that  the  application 
will  have  the  ability  to  provide  computer  based  education  and  training  resources  to  the 
CMD  in  a  format  that  does  not  distort  the  digital  media  and  operates  without  significant 
degradation  in  the  quality  of  the  training  in  comparison  to  the  current  state.  Therefore,  if 
the  training  itself  is  of  the  same  quality,  the  ease  of  use  will  be  entirely  dependent  on  the 
user’s  ability  to  easily  navigate  the  applications  interface,  find  the  training  he/she  desires, 
complete  that  training,  and  then  update  their  personal  training  record.  This  ease  of  use 
could  also  depend  on  the  user’s  familiarity  with  the  CMD  that  the  application  is  running 
on. 

In  COA  3  of  this  case  the  BYOD  implementation  strategy  was  proposed.  A 
BYOD  implementation  would  mean  that  the  individual  was  able  to  access  the  training  on 
a  device  of  his/her  choosing  and  therefore  possibly  more  familiar  with.  The  main  ease  of 
use  issue  regarding  this  COA  is  that  some  Marines  may  potentially  not  own  a  CMD.  In 
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this  case,  those  Marines  would  be  required  to  borrow  another  individual’s  CMD,  which 
may  be  unfamiliar  to  him/her,  which  would  decrease  that  individual’s  perceived  ease  of 
use. 

The  solution  to  this  issue  is  COA  2,  which  requires  the  Marine  Corps  to  furnish  a 
CMD  to  each  Marine  or  each  unit.  The  choose  your  own  device  (CYOD)  implementation 
strategy  allows  the  individual  to  operate  on  a  CMD  that  they  are  familiar  with,  and 
ensures  that  all  Marines  have  access  to  a  CMD  to  complete  their  training.  This  COA  has 
the  potential  to  result  in  a  higher  cost  to  the  organization  due  to  the  fact  that  it  requires 
the  government  to  develop  an  application  that  can  run  on  multiple  platforms,  and  to 
furnish  the  CMDs  to  the  individuals. 

COA  1,  uses  a  here’s  your  own  device  (HYOD)  implementation  strategy,  which 
could  address  the  cost  of  developing  an  application  that  works  across  platforms,  due  to 
the  government  choosing  to  provide  only  one  platform  with  compatibility.  The 
government  could  also  save  money,  in  comparison  to  COA  2,  by  purchasing  only  one 
type  CMD  and  therefore  buying  the  devices  in  bulk.  This  COA  however  has  the  potential 
to  lower  the  perceived  ease  of  use  of  some  individuals  that  may  not  be  familiar  with  the 
provided  CMD  platform.  Each  of  these  COAs  provides  a  give  and  take  in  terms  of  the 
degree  to  which  they  will  be  perceived  as  easy  to  use  and  useful  to  the  individual. 

Using  the  Technology  Acceptance  Model,  the  end  users  should  choose  to  use  the 
new  technology  if  the  perceived  usefulness  is  high  in  comparison  to  the  negative  aspects 
of  the  perceived  ease  of  use.  Therefore,  if  the  application  and  the  technology  work  well 
together  and  the  individual  believes  they  are  useful  in  terms  of  their  career  development 
the  technology  should  be  accepted  and  used.  If  the  application  is  difficult  to  operate,  and 
the  device  is  unfamiliar  to  the  individual,  the  perceived  ease  of  use  is  likely  to  be  more  of 
a  negative  factor  and  could  potentially  outweigh  the  positive  useful  aspect  to  the 
individual. 
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3.  Confidentiality,  Integrity,  and  Availability  Analysis 

Mobile  learning  through  a  CMD  has  the  potential  to  increase  productivity  and 
collaboration  in  an  educational  environment.  The  IT  policies  at  Naval  Postgraduate 
School  (NPS)  recognize  that  their  students’  success  depends  on  “the  availability, 
flexibility,  reliability,  and  capacity  of  the  NPS  academic  technology  infrastructure” 
(Naval  Postgraduate  School,  2009,  p.  10).  However,  the  benefits  of  implementing  this 
technology  do  come  with  some  risks.  These  risks  can  be  mitigated  to  some  degree  with 
an  appropriate  implementation  strategy  and  the  use  of  technologies  like  virtual  desktop 
infrastructure  (VDI),  trusted  platform  module  (TPM),  mobile  device  management 
(MDM),  and  application  access  controls.  These  technologies  can  improve  confidentiality 
and  integrity;  however,  they  are  often  associated  with  some  decrease  in  availability  from 
the  end  users  prospective. 

Each  COA  presented  in  this  case  has  varying  levels  of  risk  related  to 
confidentiality,  integrity,  and  availability  (CIA)  from  the  perspective  of  the  organization. 
The  training  and  education  resources  that  the  application  provides  access  to  are,  for  the 
purposes  of  this  research,  not  classified  and  confidentiality  is  a  minor  concern  to  the 
organization.  Assuming  that  the  application  is  developed  with  multi-factor  authentication 
the  Marine  Corps  could  be  reasonably  assured  that  only  those  individuals  that  have  a 
reason  to  access  the  resources  are  able  to  access  the  resources.  The  application  should  be 
set  up  in  a  manner  that  does  not  allow  an  individual  to  use  the  application  to  alter  the 
training  or  resources  in  any  way,  which  leaves  only  the  issue  of  training  record  update 
integrity.  The  application  should  only  be  able  to  access  and  update  the  training  record  of 
the  authenticated  user  using  the  device. 

One  integrity  issue  that  this  technology  would  be  vulnerable  to  fraudulent  training 
completion.  In  this  hypothetical  scenario,  a  Marine  gains  access  to  the  application  and 
then  allows  another  individual  to  complete  the  training  for  him/her.  This  issue  is  not 
likely  to  be  prevented  with  any  technology  that  the  researcher  is  aware  of.  This  researcher 
has  not  personally  observed  this  occur,  however  it  is  an  issue  of  the  current  MarineNet 
system. 
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With  respect  to  the  proposed  COAs  in  this  case  study,  COA  3  has  the  highest 
potential  for  risk  in  terms  of  CIA.  Allowing  individual  Marines  to  access  and  store  the 
organizational  information  from  MarineNet  on  their  personal  devices  is  potentially  riskier 
than  a  government  furnished  device.  This  would  be  due  in  part  to  the  individual  security 
settings  of  the  personally  owned  device  and  the  other  applications  installed  on  the  device. 
COA  1  and  COA  2  are  essentially  variations  on  a  program  that  requires  the  government 
to  furnish  a  device  to  the  individual.  Because  the  government  furnishes  the  device,  the 
government  could  potentially  have  greater  oversight  on  the  device  and  more  tightly 
control  the  settings  and  applications,  thereby  potentially  lowering  the  confidentiality  and 
integrity  risks. 

4.  Analysis  Summary 

Allowing  CMD  access  to  training  and  education  courses  and  resources  currently 
available  on  MarineNet  in  any  of  the  COAs  developed  for  this  case  study  presents  risk  to 
the  organization.  The  new  technology  has  a  risk  of  not  being  accepted  by  the  individuals 
expected  to  utilize  it,  making  the  implementation  unsuccessful.  Additionally,  risks  exist 
in  terms  of  confidentiality  and  integrity  of  the  organizations  data.  The  degree  to  which 
these  risks  are  outweighed  by  the  potential  benefits  should  be  considered  before  pursuing 
any  of  these  COAs. 

C.  CASE  2  ANALYSIS 

In  the  background  and  explanation  of  case  study  2,  the  use  of  CMD  technology 
was  presented  as  a  potential  means  of  increasing  collaboration  and  improving  the 
efficiency  of  squadron  flight  schedule  development  in  the  Marine  Corps.  This  case 
focused  on  the  capability  of  key  stakeholders  to  collaborate  in  the  development  and 
approval  process  of  a  squadron  flight  schedule.  The  daily  flight  schedule  development 
and  approval  process  was  described  in  detail  to  show  that  a  properly  developed  mobile 
application  running  on  a  CMD  could  provide  make  the  process  more  efficient. 
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1.  Socio technical  Systems  Theory  Analysis 

The  squadron  daily  flight  schedule  development  and  approval  process  is  a  very 
social  process.  In  its  current  state,  the  process  involves  the  technology  only  in  the 
development,  and  after  the  approval.  Through  the  use  of  an  application  running  on  CMDs 
in  the  hands  of  the  key  stakeholders,  the  technology  is  involved  throughout  the  process. 
From  a  STS  perspective,  the  implementation  of  this  technology  could  have  implications 
on  the  social  and  technical  sides  of  the  process. 

In  terms  of  social  impact,  the  implementation  of  this  technology  could  alter  the 
relationships  among  the  key  stakeholders.  In  this  implementation,  the  application  would 
have  the  ability  to  allow  real  time  collaboration  between  all  of  the  key  stakeholders,  and 
potentially  the  Commanding  Officer  during  all  stages  of  flight  schedule  development. 
This  change  in  relationships  among  the  key  stakeholders  is  one  of  the  major  potential 
benefits  of  implementing  CMD  technology  into  this  process.  Rather  than  the  current 
system  of  developing  the  schedule  and  allowing  each  individual  key  stakeholder  to  make 
his/her  changes  with  no  visibility  of  those  change  to  the  others,  this  technology  is 
proposed  to  allow  real  time  visibility  of  those  changes.  The  benefit  of  altering  the 
relationships  and  increasing  collaboration  would  be  to  decrease  the  work  and  re-work 
time  of  the  schedule. 

In  terms  of  the  technical  impact,  this  technology  should  decrease  the  complexity 
of  the  process.  Decreasing  complexity  and  increasing  the  efficiency  in  terms  of  time  is 
the  major  benefit  of  the  technology  in  this  case.  If  the  application  and  the  implementation 
of  the  technology  increases  complexity  of  the  process,  then  the  implementation  would 
likely  fail. 

2.  Technology  Acceptance  Model  Considerations 

Case  2  involves  the  development  of  an  application  allowing  collaborative 
capability  in  squadron  flight  schedule  development.  The  main  technology  factor  in  this 
case  is  the  application  and  its  ability  to  run  on  a  CMD.  The  collaborative  capability  and 
the  mobility  of  the  key  stakeholder  are  the  two  biggest  benefits  gained  by  implementing 
this  technology.  Using  the  Technology  Acceptance  Model  to  analyze  this  case,  each  COA 
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is  likely  to  have  varying  degrees  of  perceived  usefulness  and  perceived  ease  of  use  from 
the  perspective  of  the  end  user  (key  stakeholder). 

Perceived  usefulness  is  the  major  factor  in  this  case  in  determining  how  the 
technology  will  be  accepted  by  the  end  user.  The  degree  to  which  the  key  stakeholders 
believe  the  application  increases  collaboration,  decreases  the  amount  of  time  they  spend 
on  development  and  approval,  and  the  additional  freedom  they  have  to  complete  the  task 
away  from  their  traditional  workspace  will  all  factor  into  the  perceived  usefulness  of  the 
technology.  This  research  assumes  that  the  application  is  developed  to  address  these 
factors  affecting  perceived  usefulness.  Assuming  that  the  application  is  developed  for  a 
specific  CMD  platform  (as  is  the  case  in  COA  1),  or  multiple  platforms  (as  is  the  case  in 
COA  2,  and  3)  there  should  be  no  difference  in  perceived  usefulness  between  the 
respective  CO  As. 

The  perceived  ease  of  use  of  this  technology  is  affected  by  the  COA  selected.  In 
COA  1,  a  HYOD  implementation  plan  was  proposed.  This  COA  has  the  potential  for 
slightly  lower  perceived  ease  of  use.  This  is  due  to  the  potential  for  a  particular  CMD 
platform  being  selected,  and  the  individual  key  stakeholder  lacking  familiarity  with  that 
platform.  COA  2  and  COA  3  both  decrease  the  likelihood  of  this  outcome  by  increasing 
the  number  of  platforms  that  are  supported.  Additionally,  regardless  of  COA  selected,  if 
the  application  is  developed  without  significant  input  from  the  individuals  that  are  experts 
in  the  process,  the  potential  exists  that  the  application  has  low  usefulness  and  low  ease  of 
use.  In  this  scenario,  the  implementation  is  likely  to  fail  to  improve  the  process. 

3.  Confidentiality,  Integrity,  and  Availability  Analysis 

Similar  to  Case  1,  CMD  technology  implementation  in  this  case  has  the  potential 
to  benefit  the  process  in  terms  of  information  availability.  This  benefit  comes  at  a  cost  of 
potential  threats  to  confidentiality  and  integrity  of  the  data.  Squadron  daily  flight 
schedules  are  not  classified,  but  they  are  protected  from  disclosure  for  operational 
security  reasons.  The  M-SHARP  system  contains  personally  identifiable  information 
(PII)  and  unit  readiness  statistics  that  require  protection  from  threats  to  confidentiality 
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and  integrity.  With  access  to  the  system,  and  bad  intentions,  an  individual  could 
potentially  cause  erroneous  information  to  be  inserted  causing  a  lack  of  data  integrity. 

Assuming  that  the  application  is  developed  with  multi-factor  authentication  the 
Marine  Corps  could  be  reasonable  assured  that  only  those  individuals  that  have  a  reason 
to  access  the  resources  are  able  to  access  the  resources.  This  could  prevent  issues  with 
regard  to  confidentiality.  Additionally,  the  application  could  be  set  up  in  a  manner  that 
does  not  allow  an  individual  to  use  the  application  to  alter  the  readiness  information  in 
any  way.  In  this  configuration  the  application  would  be  able  to  “read  only”  the  readiness 
and  qualification  information  in  the  system,  and  would  be  able  to  “write”  only  to  the 
daily  flight  schedule.  This  would  limit  the  potential  for  issues  with  integrity. 

Each  individual  COA  would  have  slightly  different  risk  levels  with  regard  to  CIA. 
COA  1  implementation,  has  the  potential  for  the  least  risk.  In  this  COA,  the  government 
owns  all  the  devices  that  are  able  to  use  the  application,  and  is  responsible  for 
maintaining  the  configuration  and  security  of  the  CMDs.  COA  2  has  a  potential  has 
similar  risk  to  COA  1.  In  this  implementation,  the  government  owns  a  selection  of  CMD 
platforms  that  the  individual  is  able  to  use.  The  CIA  risk  is  slightly  higher  here,  due  to  the 
requirement  of  the  government  to  manage  multiple  platforms  settings  and  security.  Each 
of  these  COAs  has  the  potential  to  limit  availability,  due  to  the  limited  number  of  CMDs 
allotted  to  the  unit.  COA  3  increases  availability  due  to  the  development  of  the 
application  to  run  on  multiple  CMD  platforms.  Additionally,  in  this  COA  the  number  of 
devices  with  access  to  the  system  is  limited  by  the  number  of  authorized  users  the 
organization  chooses  to  allow  (assuming  that  all  the  key  stakeholders  and  their  alternates 
own  a  CMD).  This  COA  has  the  potential  for  the  highest  risk  in  terms  of  confidentiality 
and  integrity,  in  that  it  would  require  the  organization  to  manage  access. 

4.  Analysis  Summary 

Implementing  CMD  technology  into  the  squadron  daily  flight  scheduling  process 
in  any  of  the  COAs  developed  for  this  case  study  presents  risk  to  the  organization.  Risks 
exist  in  terms  of  confidentiality  and  integrity  of  the  organizations  data.  Through  an 
appropriately  developed  application,  and  diligent  access  management  by  the  organization 
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these  risks  could  potentially  be  mitigated  to  an  acceptable  level.  The  degree  to  which  the 
resultant  risk  is  outweighed  by  the  potential  benefits  should  be  considered  before 
pursuing  any  of  these  COAs. 

D.  CASE  3  ANALYSIS 

In  the  background  and  explanation  of  Case  3,  the  use  of  CMD  technology  was 
presented  as  a  potential  means  of  increasing  collaboration,  interoperability,  and 
improving  the  efficiency  of  the  member  assigned  to  conduct  an  aviation  mishap 
investigation.  This  case  focused  on  the  issues  of  training  the  members  of  the  board, 
changing  out  members  of  the  board,  and  collaborating  on  the  investigation.  The  aviation 
mishap  investigation  process  was  described  to  show  the  complexity  of  the  process  and 
that  a  properly  developed  mobile  application  running  on  a  CMD  could  provide  make  the 
process  more  efficient. 

1.  Socio technical  Systems  Theory  Analysis 

The  process  of  conducting  an  aviation  mishap  investigation  is  by  its  very  nature  a 
social  process.  In  its  current  state,  the  process  involves  several  individuals  conducting 
investigative  tasks  within  their  area  of  expertise  independently  and  then  periodically 
collaborating  to  develop  the  investigation  report.  In  this  process,  the  individuals  use 
personal  CMDs  to  conduct  portions  of  the  investigation,  but  must  use  a  laptop  or  desktop 
computer  to  input  the  evidence  and  findings  into  the  online  investigation  report  system. 
From  a  STS  perspective,  the  implementation  of  this  technology  could  have  implications 
on  the  social  and  technical  sides  of  the  process. 

In  terms  of  social  impact,  the  implementation  of  this  technology  could  alter  the 

relationships  among  the  mishap  board  members.  In  this  implementation,  the  application 

would  have  the  ability  to  allow  members  to  collaborate  during  the  investigation  and 

development  of  the  investigation  report.  The  additional  benefit  of  implementing  this 

technology  is  the  interchangeability  of  the  members  on  the  board.  The  application  could 

allow  new  members  to  be  assigned  and  removed  from  the  board  as  desired  by  the 

Commanding  Officer  or  investigative  authority.  The  availability  of  the  application  on 

CMDs  has  the  potential  to  allow  any  member  of  the  squadron  with  the  application  to 
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collect  digital  evidence  and  provide  it  to  the  mishap  board.  If  the  application  were 
developed  with  various  roles,  every  member  of  the  command  with  a  CMD  could  be  given 
the  ability  to  take  pictures  or  give  statements  to  the  board  through  the  application, 
without  having  access  to  the  entire  body  of  evidence  and  findings. 

In  terms  of  the  technical  impact,  this  technology  is  likely  to  increase  the 
complexity  of  the  process  to  a  certain  degree.  Allowing  a  potentially  larger  group  of 
individuals  to  collect  evidence  and  provide  that  evidence  to  the  board  has  the  potential  to 
cause  redundant  information  to  be  provided.  Additionally,  this  application  could  increase 
the  amount  of  irrelevant  information  causing  the  investigation  to  potentially  take  more 
time  to  complete  than  necessary. 

The  second  technical  impact  is  that  the  application  is  unlikely  to  replace  the 
desktop  or  laptop  in  the  development  of  the  investigation  report.  CMDs  are  recognized  as 
having  a  keyboard  capability  (either  touchscreen  or  peripheral  device),  however  the 
researcher  has  observed  these  devices  to  be  cumbersome  when  doing  a  significant 
amount  of  writing  in  a  text  editor  program.  These  technical  issues  and  the  social  impact 
of  this  technology  could  impact  the  acceptance  of  this  technology  in  the  process. 

2.  Technology  Acceptance  Model  Considerations 

Case  3  involves  the  development  of  an  application  allowing  data  collection  and  a 
collaborative  capability  in  investigating  an  aviation  mishap.  The  main  technology  factor 
in  this  case  is  the  application  and  its  ability  to  run  on  a  CMD.  The  mobility  of  the 
individuals  conducting  the  investigation  is  the  biggest  benefit  gained  by  implementing 
this  technology.  Using  the  Technology  Acceptance  Model  to  analyze  this  case,  each  COA 
is  likely  to  have  varying  degrees  of  perceived  usefulness  and  perceived  ease  of  use  from 
the  perspective  of  the  end  user. 

Perceived  usefulness  is  the  major  factor  in  this  case  in  determining  how  the 
technology  will  be  accepted  by  the  end  user.  It  is  possible  that  the  use  of  this  technology 
is  only  perceived  to  be  useful  from  the  viewpoint  of  the  Aviation  Safety  Officer  and  the 
members  of  the  mishap  board.  These  individuals  could  benefit,  in  terms  of  efficiency, 
through  the  ability  to  collect  evidence  and  collaborate  with  other  members  of  the  board. 
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The  degree  to  which  these  individuals  believe  these  benefits  will  be  realized  through 
using  CMD  technology  will  directly  impact  their  perception  of  usefulness.  Assuming  that 
the  application  is  developed  for  a  specific  CMD  platform  (as  is  the  case  in  COA  1),  or 
multiple  platforms  (as  is  the  case  in  COA  2,  and  3)  there  should  be  no  difference  in 
perceived  usefulness  between  the  respective  COAs. 

Similar  to  Case  2’s  analysis,  the  perceived  ease  of  use  of  this  technology  is 
affected  by  the  COA  selected.  In  COA  1,  a  HYOD  implementation  plan  was  proposed. 
This  COA  has  the  potential  for  slightly  lower  perceived  ease  of  use,  due  to  the  potential 
for  an  individual  lacking  familiarity  with  the  particular  CMD  platform  selected.  COA  2 
and  COA  3  both  decrease  the  likelihood  of  this  outcome  by  increasing  the  number  of 
platforms  that  are  supported.  Similar  to  Case  2’s  analysis,  if  the  application  is  developed 
without  significant  input  from  the  experts  in  the  process,  the  potential  exists  that  the 
application  has  low  usefulness  and  low  ease  of  use.  From  the  user’s  perspective,  if  the 
application  is  well  developed  and  runs  on  a  CMD  platform  that  he/she  is  familiar  with, 
the  technology  should  be  perceived  as  having  a  high  ease  of  use.  If  the  user’s  perception 
is  that  the  positive  benefits  in  terms  of  usefulness  of  the  technology  are  higher  than  the 
negative  aspects  of  ease  of  use,  the  technology  could  be  accepted. 

3.  Confidentiality,  Integrity,  and  Availability  Analysis 

CMD  technology  implementation  in  this  case  has  the  potential  to  benefit  the 
process  in  terms  of  mobility  and  collaboration.  To  gain  these  benefits,  the  CMD  and  the 
application  increase  the  availability  of  data.  This  benefit  comes  at  a  cost  of  potential 
threats  to  confidentiality  and  integrity  of  that  data.  The  system  currently  used  in  aviation 
safety  investigation  contains  PII,  and  privileged  information  that  require  protection  from 
threats  to  confidentiality  and  integrity. 

Similar  to  Case  2’s  analysis,  an  individual  with  bad  intentions  could  potentially 
cause  erroneous  information  to  be  inserted  causing  a  lack  of  data  integrity.  Beyond  that, 
the  compromise  of  privileged  information  could  have  criminal  implications  and  cause 
embarrassment  to  the  Department  of  Navy  (DON).  Additionally,  the  entire  aviation 
safety  mishap  investigation  process  could  experience  a  reluctance  to  provide  information 
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by  witnesses  due  to  a  fear  that  privileged  information  will  be  compromised  on  the  new 
system.  The  need  for  confidentiality  could  supersede  the  desire  for  increased  availability 
in  this  case.  This  research  recognizes  that  if  the  CMD  and  application  are  unable  to 
provide  acceptable  confidentiality  of  the  data,  then  the  implementation  could  fail. 

In  this  case,  multi-factor  authentication  may  not  provide  the  DON  enough 
assurance  that  only  those  individuals  that  have  a  reason  to  access  the  resources  are  able  to 
access  the  resources.  It  may  be  necessary  to  create  different  roles  in  the  application,  that 
allow  certain  individuals  the  ability  to  put  information  into  the  system  with  no 
information  retrieval  capability,  while  allowing  the  investigation  board  members  full 
access.  In  this  scenario,  any  member  of  a  squadron  could  have  the  application  on  their 
personal  CMD  and  take  pictures,  record  audio/video,  and  scan  documents  for  upload  into 
the  system.  Those  individuals  would  have  no  ability  to  access  anything  in  the  system  to 
include  other  data  or  board  deliberations.  This  could  prevent  the  disclosure  of  privileged 
information  to  an  acceptable  level  and  address  potential  integrity  and  confidentiality 
issues. 

Each  individual  COA  would  have  slightly  different  risk  levels  with  regard  to  CIA. 
COA  1  implementation  has  the  potential  for  the  least  risk.  In  this  COA,  the  government 
owns  all  the  devices  that  are  able  to  use  the  application,  and  is  responsible  for 
maintaining  the  configuration  and  security  of  the  CMDs.  This  would  provide  the  lowest 
risk  to  confidentiality  and  integrity,  but  would  minimize  the  positive  aspects  of 
availability  to  only  individuals  with  government  furnished  CMDs.  COA  2  has  a  potential 
for  similar  risk  to  COA  1.  In  this  implementation,  the  government  owns  a  selection  of 
CMD  platforms  that  the  individual  is  able  to  use.  The  CIA  risk  is  slightly  higher  here,  due 
to  the  requirement  of  the  government  to  manage  multiple  platforms  settings  and  security. 
COA  3  increases  availability  due  to  the  development  of  the  application  to  run  on  multiple 
CMD  platforms.  The  number  of  devices  with  access  to  the  system  in  this  COA  is  limited 
by  the  number  of  authorized  users  the  organization  chooses  to  allow  (assuming  that  all 
the  key  stakeholders  and  their  alternates  own  a  CMD).  This  COA  has  the  potential  for  the 
highest  risk  in  terms  of  confidentiality  and  integrity,  in  that  it  would  require  the 
organization  to  manage  the  roles  of  individuals  using  the  application. 
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4.  Analysis  Summary 

Implementing  CMD  technology  into  the  investigation  process  of  an  aviation 
mishap  presents  risk  to  the  organization.  In  terms  of  confidentiality,  disclosure  of 
privileged  information  could  be  highly  detrimental  to  the  process.  In  terms  of  integrity, 
unauthorized  or  unwanted  alteration  of  the  data  could  lead  to  erroneous  investigation 
findings  leading  to  similar  mishaps  occurring.  Through  an  appropriately  developed 
application,  and  diligent  role  based  access  management  by  the  organization  these  risks 
could  potentially  be  mitigated  to  an  acceptable  level.  The  degree  to  which  the  resultant 
risk  is  outweighed  by  the  potential  benefits  should  be  considered  before  pursuing  any  of 
these  COAs. 

E.  SUMMARY 

Each  of  the  cases  and  their  individual  COAs  vary  in  terms  of  risks  and  benefits  to 
the  organization.  These  cases  represent  three  very  different  processes  that  could 
potentially  benefit  from  allowing  CMD  technology  in  the  USMC.  This  research  analyzed 
each  potential  case  and  COA  in  terms  of  STS  theory,  the  Technology  Acceptance  Model, 
and  the  CIA  risks  versus  benefits.  The  specific  analyses  of  each  of  these  cases  display 
that  a  single  “best”  implementation  strategy  for  all  processes  is  available.  Each  case 
should  be  looked  at  individually,  and  an  individual  solution  selected  in  order  to  minimize 
the  risks  and  maximize  the  benefits. 
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V.  CONCLUSIONS  AND  RECOMMENDATIONS 


A.  CONCLUSIONS 

The  cases  developed  in  this  research,  and  the  corresponding  analysis  has  shown 
that  the  implementation  of  commercial  mobile  devices  (CMD)  into  business  processes  in 
the  United  States  Marine  Corps  (USMC)  is  a  complex  balance  between  increasing 
information  availability  and  information  security.  Each  of  the  individual  cases  shows  the 
complexity  of  the  integration  of  the  technology  with  the  users  in  terms  of  sociotechnical 
systems  (STS)  theory.  The  cases  show  that,  in  terms  of  the  technology  acceptance  model 
(TAM),  that  “perceived  usefulness”  is  relatively  constant  between  the  courses  of  action 
(COA).  However,  “perceived  ease  of  use”  varies  with  the  implementation  strategy 
selected,  which  directly  affects  the  user  acceptance  of  the  technology.  Finally,  the  cases 
and  analysis  show  that  increasing  availability  of  information  has  a  corresponding 
elevated  risk  associated  with  the  confidentiality  and  integrity  of  the  information. 

B.  FINDINGS  AND  RECOMMENDATIONS 

The  findings  and  recommendations  of  this  research  make  the  assumption  that  the 
USMC  desires  to  pursue  implementing  CMD  technology  in  the  individual  case’s  process. 
Within  each  individual  case,  a  specific  COA  is  recommended  as  the  best  choice  from  the 
perspective  of  the  organization.  It  is  assumed  that  the  organization  desires  to  minimize 
cost  and  risks,  while  maximizing  user  satisfaction  and  benefits.  In  some  of  these  cases,  an 
additional  modified  hybrid  COA  is  recommended  which  would  need  to  be  researched  in 
greater  detail  by  follow-on  studies  to  determine  feasibility. 

1.  Case  1  Findings 

Case  1  involved  the  use  of  CMD  technology  to  address  resource  limitations  and 
improve  training  and  education  efficiency  in  the  USMC.  The  findings  of  the  analysis  of 
the  individual  implementation  COAs  are  displayed  in  Table  3. 
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Table  3.  Case  1  Findings 


CASE  1  FINDINGS 

Strengths 

Weaknesses 

COA  1 
(HYOD) 

•  Lowest  potential  cost  to  the 
government  in  terms  of  technical 
support 

•  Lowest  cost  in  application 
compatibility 

•  Lowest  risk  to  the  organization 
in  terms  of  confidentiality  and 
integrity 

•  Lowest  risk  to  the  organization 
in  terms  of  confidentiality  and 
integrity 

•  Requires  government  to  furnish 
a  specific  device  configuration 

•  Potential  for  high  cost  to 
government  in  terms  of 
purchasing  a  specific  device 
configuration 

•  Lowest  potential  for  user 
familiarity 

•  Lower  "perceived  ease  of  use”  if 
individual  is  unfamiliar  with 
provided  device 

COA  2 
(CYOD) 

•  Moderate  potential  for  user 
familiarity 

•  Moderate  potential  cost  to  the 
government  in  terms  of  technical 
support 

•  Moderate  cost  in  application 
compatibility 

•  Lower  risk  to  the  organization  in 
tenns  of  confidentiality  and 
integrity 

•  Requires  government  to  furnish 
a  collection  of  device 
configurations 

•  Potential  for  highest  cost  to 
government  in  terms  of 
purchasing  multiple  device 
configurations 

•  Lower  “perceived  ease  of  use”  if 
individual  is  unfamiliar  with 
provided  device 

COA  3 
(BYOD) 

•  Highest  user  familiarity 

•  Potential  for  highest  “perceived 
ease  of  use” 

•  Lowest  potential  cost  to 
government  in  terms  of 
purchasing  devices 

•  Highest  potential  for  increasing 
availability  of  access 

•  Highest  potential  for  widespread 
use  in  the  organization 

•  Assumes  all  users  own  a  CMD 

•  Lower  “perceived  ease  of  use”  if 
user  does  not  own  a  CMD 

•  Highest  potential  cost  in  terms 
of  technical  support 

•  Highest  cost  to  the  individual 
user  in  terms  of  purchasing 
device 

•  Highest  cost  in  application 
compatibility 

•  Highest  risk  to  the  organization 
in  terms  of  confidentiality  and 
integrity 
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The  implementation  of  this  technology  has  the  potential  to  apply  to  all  Marines  in 
the  USMC,  both  active  duty  and  reservists.  The  number  of  potential  users  in  this  case 
could  make  the  pursuit  of  COA  1  and  COA  2  cost  prohibitive,  due  to  the  requirement  for 
the  USMC  to  purchase  devices  for  all.  Due  to  this  main  factor,  it  is  the  recommendation 
of  this  research  that  COA  1  is  pursued  by  the  USMC.  This  COA  minimizes  the  cost  to  the 
government  in  terms  of  purchasing  CMDs  and  takes  advantage  of  the  devices  that  users 
already  own.  This  COA  also  takes  advantage  of  the  user’s  familiarity  with  their  device, 
which  could  lead  to  a  higher  acceptance  of  the  technology  into  the  process. 

COA  3  could  result  in  higher  costs  in  terms  of  application  compatibility  and 
technical  support.  These  potential  costs  are  minimal  in  comparison  to  the  cost  of 
acquiring  and  maintaining  the  number  of  devices  required  in  COA  1  and  COA  2.  The 
main  weakness  of  selecting  COA  3  is  the  expectation  that  potential  users  may  not  own  a 
CMD.  Because  of  this  expectation,  some  users  would  potentially  not  have  the  ability  to 
access  the  information  and  realize  the  benefits.  It  is  therefore  suggested  that  a  hybrid 
COA  may  be  the  most  beneficial. 

The  possible  hybrid  COA  involves  selecting  COA  3,  and  a  limited  COA  1 
implementation.  In  this  COA,  the  application  could  be  developed  to  run  on  user  owned 
CMDs,  providing  access  to  those  individuals.  The  USMC  could  then  purchase  a  limited 
number  of  government  furnished  CMDs  to  the  individual  units  for  temporary  loan  to 
individuals  that  do  not  own  their  own  CMD.  This  would  present  an  additional  cost  to  the 
government,  but  would  maximize  utilization  of  the  technology. 

2.  Case  2  Findings 

Case  2  involved  the  use  of  CMD  technology  to  improve  collaboration  and 
efficiency  in  the  squadron  daily  flight  schedule  development  process.  The  findings  of  the 
analysis  of  the  individual  implementation  COAs  are  shown  in  Table  4. 


91 


Table  4.  Case  2  Findings 


CASE  2  FINDINGS 

Strengths 

Weaknesses 

COA  1 
(HYOD) 

•  Lowest  potential  cost  to  the 
government  in  terms  of  technical 
support 

•  Lowest  cost  in  application 
compatibility 

•  Lowest  risk  to  the  organization 
in  terms  of  confidentiality  of  PII 

•  Lowest  risk  to  the  organization 
in  terms  of  integrity  of  readiness 
data 

•  Requires  government  to  furnish 
a  specific  device  configuration 

•  Potential  for  high  cost  to 
government  in  terms  of 
purchasing  a  specific  device 
configuration 

•  Lowest  potential  for  user 
familiarity 

•  Lower  “perceived  ease  of  use”  if 
individual  is  unfamiliar  with 
provided  device 

COA  2 
(CYOD) 

•  Moderate  potential  for  user 
familiarity 

•  Moderate  potential  cost  to  the 
government  in  tenns  of  technical 
support 

•  Moderate  cost  in  application 
compatibility 

•  Lower  risk  to  the  organization  in 
terms  of  confidentiality  and 
integrity 

•  Requires  government  to  furnish 
a  collection  of  device 
configurations 

•  Potential  for  highest  cost  to 
government  in  tenns  of 
purchasing  multiple  device 
configurations 

•  Lower  “perceived  ease  of  use”  if 
individual  is  unfamiliar  with 
provided  device 

COA  3 
(BYOD) 

•  Highest  user  familiarity 

•  Potential  for  highest  “perceived 
ease  of  use” 

•  Lowest  potential  cost  to 
government  in  terms  of 
purchasing  devices 

•  Highest  potential  for  increasing 
availability  of  access 

•  Highest  potential  for  larger  pool 
of  users  collaborating 

•  Assumes  all  users  own  a  CMD 

•  Lower  “perceived  ease  of  use”  if 
user  does  not  own  a  CMD 

•  Highest  potential  cost  in  terms 
of  technical  support 

•  Highest  cost  to  the  individual 
user  in  terms  of  purchasing 
device 

•  Highest  cost  in  application 
compatibility 

•  Highest  risk  to  the  organization 
in  tenns  of  confidentiality  and 
integrity 
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The  implementation  of  this  technology  would  affect  a  much  smaller  group  of 
users  than  Case  1.  This  case  only  addressed  USMC  aviation  squadron  scheduling,  and 
focused  primarily  on  the  interactions  between  key  stakeholders  in  the  process.  The 
analysis  of  this  case  addressed  the  elevated  need  for  confidentiality  of  personally 
identifiable  information  (PII)  and  maintaining  the  integrity  of  the  squadron  readiness 
data.  Due  to  the  relatively  small  number  of  potential  CMDs  requiring  access,  and  the 
elevated  risks,  it  is  the  recommendation  of  this  research  that  either  COA  1  or  COA  2  be 
pursued  by  the  USMC. 

COA  2  would  result  in  the  highest  cost  to  the  organization  in  terms  of  acquiring 
devices  and  providing  them  to  the  key  stakeholders.  The  cost  associated  with  COA  1 
could  be  slightly  lower  than  COA  2,  however  COA  2  has  the  advantage  of  higher  user 
familiarity  and  therefore  higher  “perceived  ease  of  use”  over  COA  1.  To  maximize  user 
familiarity  and  “perceived  ease  of  use”  in  a  COA  1  implementation,  the  USMC  could  do 
additional  research  on  the  key  stakeholders  to  determine  the  most  prevalent  CMD  among 
that  group. 

The  possibility  of  a  hybrid  implementation  of  CMD  technology  exists  in  this  case 
where  COA  1  or  COA  2  is  selected  for  the  key  stakeholders,  while  developing  the 
application  for  use  on  user  owned  CMDs  in  a  limited  capacity.  In  this  hybrid  COA,  the 
key  stakeholders  would  use  their  government  furnished  CMD  to  collaborate  on  the 
development  of  the  daily  flight  schedule.  The  remaining  members  of  the  squadron  could 
access  the  application  for  information  purposes,  and  providing  their  availability  in  the 
“snivel  log.”  Each  authorized  user  in  the  squadron  with  a  CMD  could  be  allowed  to  see 
the  daily/weekly/monthly  flight  schedules.  Additionally,  individual  aircrew  personnel 
could  provide  the  Pilot  Training  Officer  their  availability  to  be  scheduled  based  on  their 
personal  schedules. 

3.  Case  3  Findings 

Case  3  involved  the  use  of  CMD  technology  to  improve  collaboration  and 
efficiency  in  the  investigation  of  aviation  mishap.  The  findings  of  the  analysis  of  the 
individual  implementation  CO  As  are  given  in  Table  5. 
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Table  5.  Case  3  Findings 


CASE  3  FINDINGS 

Strengths 

Weaknesses 

•  Lowest  potential  cost  to  the 

•  Requires  government  to  furnish 

government  in  terms  of  technical 

a  specific  device  configuration 

support 

•  Potential  for  high  cost  to 

•  Lowest  cost  in  application 

government  in  terms  of 

COA  1 

compatibility 

purchasing  a  specific  device 

•  Lowest  risk  to  the  organization 

configuration 

(HYOD) 

in  terms  of  inappropriate 

•  Lowest  potential  for  user 

disclosure  of  privileged 

familiarity 

information 

•  Lower  “perceived  ease  of  use”  if 

•  Lowest  risk  to  the  organization 

individual  is  unfamiliar  with 

in  terms  of  integrity  of 
investigation  data 

provided  device 

•  Moderate  potential  for  user 

•  Requires  government  to  furnish 

familiarity 

a  collection  of  device 

•  Moderate  potential  cost  to  the 

configurations 

government  in  terms  of  technical 

•  Potential  for  highest  cost  to 

COA  2 

support 

government  in  terms  of 

(CYOD) 

•  Moderate  cost  in  application 

purchasing  multiple  device 

compatibility 

configurations 

•  Lower  risk  to  the  organization  in 

•  Lower  “perceived  ease  of  use”  if 

terms  of  confidentiality  and 

individual  is  unfamiliar  with 

integrity 

provided  device 

•  Highest  user  familiarity 

•  Assumes  all  users  own  a  CMD 

•  Potential  for  highest  “perceived 

•  Lower  “perceived  ease  of  use”  if 

ease  of  use” 

user  does  not  own  a  CMD 

•  Lowest  potential  cost  to 

•  Highest  potential  cost  in  terms 

government  in  terms  of 

of  technical  support 

purchasing  devices 

•  Highest  cost  to  the  individual 

•  Highest  potential  for  increasing 

user  in  terms  of  purchasing 

COA  3 

availability  of  access 

device 

•  Highest  potential  for  larger  pool 

•  Highest  cost  in  application 

(BYOD) 

of  users  collaborating 

compatibility 

•  Highest  risk  to  the  organization 
in  terms  of  inappropriate 
disclosure  of  privileged 
information 

•  Highest  risk  to  the  organization 
in  terms  of  integrity  of 
investigation  data 
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The  implementation  of  this  technology  would  affect  a  smaller  group  of  users  than 
Case  1  or  Case  2.  Additionally,  the  frequency  of  use  of  the  technology  is  much  less 
frequent  than  Case  1  or  Case  2.  The  analysis  of  this  case  addressed  the  elevated  need  for 
confidentiality  of  privileged  information  and  maintaining  the  integrity  of  the  investigation 
data  and  findings.  Due  to  the  relatively  small  number  of  potential  CMDs  requiring 
access,  the  infrequent  need  for  access,  and  the  elevated  risks,  it  is  the  recommendation  of 
this  research  that  COA  1  be  pursued  by  the  USMC. 

COA  1  has  the  lowest  risk  to  the  organization  in  terms  of  inappropriate  disclosure 
of  privileged  information.  This  is  important  because,  disclosure  of  this  information  could 
have  catastrophic  effects  on  trust  and  confidence  in  the  mishap  investigation  process  by 
potential  witnesses.  COA  1  has  the  lowest  risk  to  the  organization  in  terms  of  integrity  of 
investigation  data.  This  is  important  because,  accurate  investigation  data  and  findings  can 
directly  impact  the  ability  of  the  aviation  community  to  prevent  similar  mishaps  from 
occurring.  Erroneous  findings  along  with  not  accurately  determining  the  cause  of  the 
mishap  could  lead  to  loss  of  life  and  equipment.  Because  of  these  issues,  confidentiality 
and  integrity  are  prioritized  above  availability  in  this  case. 

It  is  recommended  that  in  implementing  COA  1,  the  USMC  acquire  CMDs  and 
assign  them  directly  to  the  squadron  Aviation  Safety  Officer  (ASO).  The  ASO  could  then 
maintain  accountability  of  the  devices  and  issue  them  on  an  “as  needed”  basis  to  the 
members  of  the  aviation  mishap  board.  It  would  be  the  responsibility  of  the  ASO  to 
maintain  these  CMDs  and  provide  training  on  their  appropriate  use  to  the  aviation  mishap 
board  members. 

4.  Findings  Summary 

Three  different  cases  were  developed  in  this  research,  and  each  case  has  been 
found  to  minimize  risk  and  maximize  benefit  through  a  different  implementation  strategy. 
This  is  due  to  the  differing  requirements  between  the  cases  in  terms  of  confidentiality, 
integrity  and  availability  of  information.  This  research  shows  that  a  single  “best” 
implementation  strategy  of  CMD  technology  for  all  cases  does  not  exist. 
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C.  RECOMMENDATIONS  FOR  FUTURE  RESEARCH 

This  research  focused  on  the  risks  and  benefits  associated  with  implementing 
CMD  technology.  The  risks  and  benefits  were  discussed  both  in  general  and  with  a  more 
case  specific  focus.  The  confidentiality  and  integrity  risks  could  change  as  CMD 
technology  and  application  security  improve.  Therefore,  future  research  should  consider 
the  state  of  technology  at  the  time  of  implementation  as  well  as  the  likely  future  state  of 
technology  in  these  areas. 

To  maximize  technology  acceptance,  it  is  recommended  that  future  research 
survey  the  potential  pool  of  users  in  any  implementation  case  to  determine  the  anticipated 
perception  among  those  users  regarding  usefulness  of  the  technology.  This  survey 
research  could  also  determine  the  expected  perceived  ease  of  use  by  determining  the 
personal  CMD  ownership  among  the  users. 
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